hunt-api-misconfig

To test for mass assignment vulnerabilities in REST APIs, submit crafted payloads targeting user and profile endpoints to detect unauthorized privilege escalation and data binding manipulation. This process identifies insecure parameter binding and provides remediation guidance.

JWT algorithm confusion is a token tampering flaw where attackers exploit key confusion or alg=none settings to forge tokens. You can detect this by applying targeted JWT weakness tests to your authentication endpoints to identify insecure token validation paths.

To check CORS misconfigurations with wildcard origins and credentials, test cross-origin resource sharing policies for insecure origin validations and credential allowances. This detects cross-origin abuse vectors by validating if insecure origin checks permit unauthorized access.

Yes, you can detect prototype pollution and HTTP verb tampering in GraphQL APIs by applying specialized payload tests. This identifies prototype pollution sinks leading to RCE or XSS and discovers server-side bypasses via HTTP method overrides like TRACE.

This API security testing approach works for both staging and production environments, applying misconfiguration checks to REST and GraphQL APIs. It focuses on authentication, authorization, data binding, cross-origin resources, and HTTP verb handling across active web services.