> For the complete documentation index, see [llms.txt](https://sallam.gitbook.io/sec-88/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sallam.gitbook.io/sec-88/api-sec/api-recon.md).

# API Recon

## Summary of API Security - Reconnaissance

### API Reconnaissance

#### Directory and Subdomain Analysis

* Look for API indicators in directory names like `/api`, `/api/v1`, `/v1`, `/v2`, `/v3`, `/rest`, `/swagger`, `/swagger.json`, `/doc`, `/docs`, `/graphql`, `/graphiql`, `/altair`, `/playground`.
* Subdomains like `api.target-name.com`, `uat.target-name.com`, `dev.target-name.com`, `developer.target-name.com`, `test.target-name.com` can indicate web APIs.
* Monitor HTTP Responses for statements like `{"message": "Missing Authorization token"}`.

#### Third-Party Sources

* Leverage third-party sources like GitHub, Postman Explore, ProgrammableWeb API Directory, APIs Guru, Public APIs GitHub Project, and RapidAPI Hub for information on APIs.

### Passive Reconnaissance

#### Google Dorking

* Utilize Google Dorking with queries such as inurl:"/wp-json/wp/v2/users" and intitle:"index.of" intext:"api.txt" to find publicly available API directories and key files.

#### GitDorking

* Search for files like `swagger.json` using GitDorking, and employ tools like Trufflehog for additional security checks.

#### Shodan

* Use Shodan queries like `hostname:"targetname.com"` and `"content-type: application/json"` to identify APIs based on domain and content type.

#### The Wayback Machine

* Employ The Wayback Machine to explore historical changes in API documentation, uncovering potential Zombie APIs and aiding in testing for Improper Assets Management.

### Active Reconnaissance

#### Nmap

* Use Nmap for active API reconnaissance with commands like `nmap -sC -sV [target address or network range] -oA nameofoutput`.

#### OWASP Amass

* Employ OWASP Amass for active enumeration of APIs, creating a configuration file for API keys, and using commands like `amass enum -active -d target-name.com | grep api`.

#### Directory Brute-force with Gobuster

* Use Gobuster for directory brute-force with a command like `gobuster dir -u://targetaddress/ -w /usr/share/wordlists/api_list/common_apis_160 -x 200,202,301 -b 302`.

#### Kiterunner

* Utilize Kiterunner for discovering API endpoints and resources with commands like `kr scan HTTP://127.0.0.1 -w ~/api/wordlists/data/kiterunner/routes-large.kite` and `kr brute <target> -w ~/api/wordlists/data/automated/nameofwordlist.txt`.