The architecture of today’s applications is vastly different from the past. Back in the day, applications were often built using a single language like PHP, but most modern applications are now split into two distinct sections: the frontend and the backend, as shown below:
The frontend is the web UI you see in your browser, typically written in a modern JavaScript framework such as ReactJS or AngularJS. The backend is the API (Application Programming Interface) and can be written in multiple languages.
When dealing with this type of architecture, there are certain things you need to know and get familiar with to be successful in security testing. There are several types of APIs, and they are each slightly different, so before you start API hacking, you need to understand a few things.
Understanding Different API Types
REST API (Representational State Transfer)
If you notice an application talking to a backend API, nine out of ten times it’s going to be a REST API.
Key Indicators
When examining a request in Burp Suite, the key indicators that you are dealing with a REST API include:
- JSON Data Format: The request data is a JSON string. JSON is widely used by REST APIs for data exchange.
- HTTP Methods: The application is issuing an HTTP method that maps directly to a CRUD (Create, Read, Update, Delete) operation. The PUT method is one of several HTTP methods associated with REST APIs, as shown in the table below:
| HTTP Method | Description |
| GET | Used to read a resource or retrieve information from a server. (e.g., A banking application might use a GET request to retrieve your first and last name.) |
| POST | Used to create a new resource, though people sometimes use this for updating as well. (e.g., A social media application might use a POST request to create a new message.) |
| PUT | Used to update a resource completely. (e.g., A PUT request might be used to update your password when you issue a password reset.) |
| PATCH | Used to update a resource partially. |
| DELETE | Used to delete a resource. (e.g., Deleting a comment on social media.) |
Another sign you’re dealing with a REST API is when the HTTP response contains a MIME type of JSON. As mentioned earlier, the vast majority of REST APIs use JSON, so if you get a JSON response, you’re probably dealing with a REST API.
Remote Procedure Call (RPC)
Remote Procedure Call (RPC) is the oldest form of communication you will see being used by an application, dating back to the 1980s. This protocol is fairly basic; each HTTP request maps to a particular function or method.
Key Indicators
There are several indicators that hint this is an RPC endpoint:
- File Name/Endpoint: Endpoints often contain indicators like
xmlrpc.php. - Encoding Type: The data is encoded. XML-RPC uses XML for its encoding type, while JSON-RPC uses JSON. This is the main difference between the two RPC API types.
- Method Call: In the request body (e.g., an XML document), you see tags like and . Since RPC requests correspond to function names, this is another hint. The term “method” means the same thing as “function” in this context.
- Example: If the method name is
system.listMethodswith zero arguments, the server will typically respond with a list of functions exposed by this API.
- Example: If the method name is
- Limited HTTP Methods: REST APIs use several HTTP methods (GET, POST, PUT, DELETE, etc.), but RPC APIs only use two: GET and POST. So, if you see an HTTP request using something other than a GET or POST request, you know it’s probably not an RPC API.
Simple Object Access Protocol (SOAP)
You can think of a SOAP API as a more advanced version of XML-RPC. They are both very similar in that they both use XML for encoding and HTTP to transfer messages. However, SOAP APIs tend to be a little more complex.
Key Indicators
Unlike the XML-RPC request, which is often just an XML blob of data, the SOAP request is more structured. To send a SOAP request, you must follow this specific structure.
- The Envelope Tag: The message is first wrapped in an tag. This value can be used as an indicator that you’re dealing with a SOAP API, so be on the lookout for this string.
- Header and Body: The envelope contains the
HeaderandBodytags.- The
Headerpart is optional and is used to hold values related to authentication, complex types, and other information about the message itself. - The
Bodyis the part of the XML document which actually contains the message.
- The
- Method Inside the Body: Inside the body, you will see a method name and its arguments. For example, the SOAP body might show a method named
GetCitiesByCountrybeing called and passing an argument calledCountryName.
GraphQL API
GraphQL is a data query language developed by Facebook and released in 2015. GraphQL acts as an alternative to REST API.
Key Feature and Vulnerabilities
REST APIs often require the client to send multiple requests to different endpoints to query data from the backend database. With GraphQL, you only need to send one request to query the backend. This is simpler because a single request can be used to gather all the necessary information.
As new technologies emerge, so will new vulnerabilities:
- Missing Authentication by Default: By default, GraphQL does not implement authentication; this is left for the developer to implement. This means that, by default, GraphQL allows anyone to query it, and any sensitive information could be available to unauthenticated attackers.
- IDOR (Insecure Direct Object Reference): GraphQL endpoints can also be vulnerable to other bugs like IDOR.
Finding and Introspecting GraphQL
When performing your directory brute force attacks, make sure to add the following paths to check for GraphQL instances:
/graphql/graphiql/graphql.php/graphql/console
Once you find an open GraphQL instance, you need to know what queries it supports. This can be done by using the introspection system.
Learn More: Introspection is a feature of GraphQL that allows a client to ask a GraphQL schema about what queries, types, and fields it supports. https://graphql.org/learn/introspection/
Issuing the following request will show you all the queries that are available on the endpoint:
example.com/graphql?query={__schema{types{name,fields{name}}}}
If the response shows a type called User with fields called username and password, for example, you’ve found something interesting. Types that start with a double underscore (__) can generally be ignored as they are part of the introspection system.
Once an interesting type is found, you can query its field values by issuing the following query:
http://example.com/graphql?query={TYPE_1{FIELD_1,FIELD_2}}
Once the query is submitted, it will pull the relevant information and return the results to you. In the example above, this could yield a set of credentials that can be used to log in to the application.
GraphQL is a relatively new technology that is starting to gain some traction among startups and large corporations, and it presents a ripe area for security testing.