NoorQureshi API testing methodology (work top to bottom)
Confirm scope first (tradecraft-scope-roe). Each phase links to the skill that goes deep — load it,
work its cheatsheet.md where present, and don't mark a phase failed until you've covered it
(house rule: fuzz every input/context/encoding, blind/OOB). This is your coverage map.
1 · Discover & map the surface
- Find the API:
/api, subdomains, JS files (recon-js-analysis), mobile/SPA traffic (recon-content-discovery) - Grab the spec:
swagger.json/openapi.json/ GraphQL introspection /.proto— enumerate every endpoint, method, param - Note auth model (Bearer/JWT/API key/cookie/mTLS), versions (
/v1,/v2), and content types - Map roles: create two accounts (and an unauth client) — you need them for access-control tests
2 · Authentication
- Token flaws — JWT alg/kid/key confusion (
web-auth-jwt), API-key leakage/predictability - Auth attacks — credential stuffing, weak/OTP flows, token not expiring/rotating (
api-auth-attacks) - Unauthenticated endpoints that shouldn't be
3 · Authorization (the #1 API bug class — go deep)
- BOLA/IDOR — swap object IDs between the two accounts on every object-taking endpoint (
api-bola,web-idor) - BFLA — call admin/privileged functions as a low-priv user; try hidden methods (PUT/DELETE/PATCH)
- Path/verb tampering,
X-Original-URL/method override, GraphQL field-level authz
4 · Input handling & injection
- Injection across params, JSON bodies, headers: SQLi (
web-sqli), NoSQL (api-mongo-agg-facet-bypass), command (web-command-injection), SSTI (web-ssti) - SSRF via URL params / webhooks / "fetch from URL" (
web-ssrf), XXE on XML endpoints (web-xxe) - Mass assignment — inject extra fields (
role,isAdmin,price) (api-mass-assignment)
5 · Data exposure & business logic
- Excessive data exposure — endpoints returning more fields than the UI shows (PII, internal flags)
- Business-logic abuse — price/quantity tampering, negative values, replay, race conditions (
web-race-conditions,web-business-logic) - Mass assignment → privilege/state change; parameter pollution (
web-http-parameter-pollution)
6 · Rate limiting & resource consumption
- Missing/bypassable rate limits (
web-rate-limit-bypass) — brute, enumeration, cost - Unbounded queries / pagination abuse; GraphQL depth/alias/batch amplification
7 · Protocol specifics
- GraphQL — introspection, batching, injection, field authz (
api-graphql) - gRPC — reflection, message tampering (
api-grpc) - REST/SOAP — verb tampering, content-type confusion, version drift (
api-versioning); fuzz systematically (api-fuzzing)
8 · Before you report
- Re-prove each finding from a clean session; anonymise data (
reporting-triage-validation) - Score it (
reporting-cvss-scoring), then write it up (reporting-bug-bounty-writeup)
Coverage bar
Every endpoint × method exercised; BOLA/BFLA tried across accounts on every object; injection fuzzed
on every input; rate-limit and business-logic checked. A phase is failed only after that — else open.