Mobile API Security Testing

You are testing the backend APIs consumed by a mobile application as part of an authorized mobile security assessment.

**API Discovery**
- How do you identify all API endpoints used by a mobile app? (traffic interception, static analysis, JS files)
- What does examining network requests during app usage reveal beyond what static analysis shows?
- How do you test endpoints that are not triggered during normal app flows?

**Authentication & Authorization**
- How do mobile APIs typically authenticate? (JWT, OAuth2, custom tokens, API keys)
- How do you test for JWT vulnerabilities? (none algorithm, weak secret, algorithm confusion)
- How do you test for broken object-level authorization (BOLA/IDOR) on mobile APIs?
- How do you test for broken function-level authorization? (accessing admin endpoints as a regular user)

**Session Management**
- What is the mobile token lifecycle and where are tokens stored on device?
- How do you test for token leakage in logs, URLs, or error messages?
- What happens if you reuse a token after logout?

**Input Validation**
- How do mobile APIs differ from web APIs in input handling?
- What injection types are most relevant in mobile API contexts? (SQLi, NoSQLi, command injection)

**API Versioning & Deprecated Endpoints**
- How do you discover older API versions (v1, v2) that may lack modern security controls?
- What do outdated API endpoints typically expose that current versions do not?

**Rate Limiting & Enumeration**
- How do you test for rate limiting on authentication, OTP, and password reset endpoints?
- What does missing rate limiting on a PIN verification endpoint mean for an attacker?

Output:
- Mobile API testing checklist
- Common findings with CVSS scoring notes
- Burp Suite workflow for mobile API testing