API Hacking: Swagger and OpenAPI Recon

1 hour ago

2 min read

Developers publish OpenAPI specs to move faster. Attackers read them for the same reason. On authorized tests, finding `/swagger`, `/openapi.json`, or a CI artifact can shrink hours of guessing into minutes of structured review.

Specs lie sometimes—deprecated routes, missing auth—but they're still a map worth walking carefully.

OpenAPI files are product intent frozen in JSON—compare them to reality and you're often reviewing two apps at once.

Where specs hide

Common paths, bundled JS, GitHub repos, and mobile app strings. Staging often exposes what production hides.

Look for multiple versions; v2 might still work when v3 is documented.

Turning spec into test ideas

For each operation, note required auth, sensitive parameters, and admin-only tags. Compare documented schemas to live responses—drift finds bugs.

Flag undocumented endpoints you discover elsewhere
Check example servers for alternate hosts
Review upload and webhook definitions closely

Operational caution

Downloading a spec isn't permission to hammer every operation. Scope still governs hosts and destructive methods.

Redact secrets before attaching specs to client reports.

OpenAPI recon is professional when it accelerates authorization review, not when it replaces thinking.

Use discovered hosts only if they're in scope—staging domains are often excluded for good reason.

Spec drift as a finding

When live behavior diverges from spec—extra fields, missing auth—file it. Specs sometimes document internal routes never meant to be public.

Generated clients in mobile repos may embed base paths and API keys placeholders worth correlating with runtime traffic.

Integrating spec into CI

Encourage clients to treat OpenAPI as contract tests—drift becomes a build failure, not a surprise pen test finding.

Red team notes: specs may list internal admin routes used by workers—validate network ACLs separately.

Compare mobile bundled OpenAPI fragments with server-hosted specs when both exist.

Worth reading next

Tools & Techniques: httpx for HTTP Probing

From Recon Data to Testing Hypotheses

API Hacking: Mass Assignment and Excess Data Exposure