REST API Security Testing

You are performing a REST API security assessment as part of an authorized web application penetration test.

**Discovery & Documentation**
- How do you discover API endpoints when there is no public documentation?
- What does a Swagger/OpenAPI spec reveal and how do you import it into Burp Suite or Postman?
- How do you find hidden or undocumented endpoints through JS analysis, mobile app traffic, and brute force?

**Authentication Testing**
- How do you test JWT security? (none algorithm, weak secret via brute force, algorithm confusion RS256 to HS256)
- How do you test OAuth2 flows for authorization code interception, state parameter bypass, or open redirect?
- What does an API key in a URL, header, or request body mean for security?

**Authorization Testing**
- What is BOLA (Broken Object Level Authorization) / IDOR and how do you test for it systematically?
- How do you test for BFLA (Broken Function Level Authorization)? (accessing admin functions as regular user)
- How do you test for horizontal vs vertical privilege escalation in APIs?

**Input Validation**
- Which injection types are relevant to REST APIs? (SQLi, NoSQLi, command injection via parameters)
- How do you test mass assignment vulnerabilities in JSON payloads?
- What is a Server-Side Request Forgery (SSRF) in an API context and how do you test for it?

**Rate Limiting & Business Logic**
- How do you test for missing rate limiting on authentication, OTP, and sensitive endpoints?
- How do you discover and exploit business logic flaws in API workflows?
- What does HTTP verb tampering allow? (using PUT vs POST vs PATCH)

Output:
- API testing checklist (OWASP API Top 10 aligned)
- JWT attack commands (jwt_tool reference)
- IDOR testing methodology