Description

API Reconnaissance

Directory and Subdomain Analysis

Look for API indicators in directory names like ```bash
 /api, /api/v1, /v1, /v2, /v3, /rest, /swagger, /swagger.json, /doc, /docs, /graphql, /graphiql, /altair, /playground. ```
Subdomains like ```bash
 api.target-name.com, uat.target-name.com, dev.target-name.com, developer.target-name.com, test.target-name.com can indicate web APIs. ``` Monitor HTTP Responses for statements like `{"message": "Missing Authorization token"}`.

Third-Party Sources

Leverage third-party sources like GitHub, Postman Explore, ProgrammableWeb API Directory, APIs Guru, Public APIs GitHub Project, and RapidAPI Hub for information on APIs.

Passive Reconnaissance
Google Dorking

Utilize Google Dorking with queries such as ```bash  inurl:"/wp-json/wp/v2/users" and intitle:"index.of" intext:"api.txt" ``` to find publicly available API directories and key files.

GitDorking

Search for files like swagger.json using GitDorking, and employ tools like Trufflehog for additional security checks.

Shodan

Use Shodan queries like

 hostname:"targetname.com" and "content-type: application/json"

to identify APIs based on domain and content type.

The Wayback Machine

Check for differences between the API documentation. Later, when you are actively testing the API, make sure to test using old endpoints

Active Reconnaissance: process of interacting directly with the target

1. Nmap
   Use Nmap for active API reconnaissance with commands like

   nmap -sC -sV ip
   nmap -p- ip  ->  allportscan
   

2. Amass
   ```bash
   amass enum -active -d domain name

sudo nano ~/.config/amass/config.ini` to add keys or secret to amass

amass enum -active -d target-name.com |grep api

3. `Directory Brute-force with Gobuster`
```bash
`gobuster dir -u http://targetname  -w wordlist`

`$ gobuster dir -u http://targetaddress/ -w /usr/share/wordlists/api_list/common_apis_160 -x 200,202,301 -b 302`

1. DevTool
   navigate network and press Ctrl+r to refresh to get api end point or url
   to interact with url press right click on it and choose copy as Curl then open Postman
   then click on import choose raw text then import it

2. Kiterunner (kr)
   tool available for discovering API endpoints and resources
   ```bash
   kr scan HTTP://127.0.0.1 -w ~/api/wordlists/data/kiterunner/routes-large.kite`

kr brute -w ~/api/wordlists` ``` ---