hunt-shadow-api

Enumerate versioned paths like /api/v1/ and /api/v2/, probe header-based versioning, and pull old OpenAPI/Swagger specs including archived copies from the Wayback Machine. Diff the endpoint inventories and confirm any old-spec-only route still returns something other than 404.

Send identical requests to both versions and compare security behavior, not response shape. Check whether the old version accepts expired or lower-privilege tokens, lacks rate limiting, accepts payloads the new version rejects, or leaks fields the new version redacts.

Shadow API work owns version inventory and behavioral diffing between old and current API versions. Once a specific endpoint or spec is in hand, exploitation techniques like mass assignment, JWT attacks, and OData abuse belong to API misconfiguration testing.

Skip it when the target has a single API version with no version history, since there is nothing to diff. In that case, go directly to testing the one existing surface for misconfigurations and injection flaws.

A version difference alone, such as cosmetic field renaming or a static deprecation notice, is informational only. The finding requires a security-relevant regression, and you must confirm the old endpoint is not just a proxy to the current implementation.