<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-api-endpoint-testing
description: >-
  Systematically test API endpoints for auth bypass, injection, rate limiting, and data exposure.
domain: cybersecurity
subdomain: bug-bounty
tags:
  - api-security
  - rest-api
  - graphql
  - bug-bounty
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing API Endpoint Testing

## Overview

Systematically test API endpoints for auth bypass, injection, rate limiting, and data exposure.

## Prerequisites

| Requirement | Install |
|---|---|
| Postman | API client |
| Burp Suite | API proxy |
| Python 3.10+ | For agent tooling |

## Key Concepts

API testing covers authentication, authorization, input validation,
rate limiting, and data exposure across REST and GraphQL.

## Quick Reference

```bash
node agent.js discover --spec https://target.com/api/openapi.json
node agent.js test-auth --url https://api.target.com --endpoints endpoints.txt
node agent.js fuzz --url https://api.target.com/users --param id
node agent.js rate-limit --url https://api.target.com/login --rps 100
```

## Workflow

1. Discover API spec
2. Map endpoints with auth
3. Test unauth access
4. Test role auth
5. Fuzz for injection
6. Test rate limiting
7. Check data exposure

## Verification

- Verify endpoint discovery
- Confirm auth testing
- Validate fuzzing
- Check rate limits
- Verify curl commands

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
