API Hacking: Webhooks and Callback Trust Issues

Webhooks are APIs that call you back. Teams forget that inbound webhook handlers are public attack surface with business side effects.

On authorized tests, map every callback URL, signing scheme, and retry behavior before you poke anything destructive.

What to verify

• Signature validation that actually covers the body

• Replay windows and idempotency keys

• Callbacks that fetch attacker-controlled URLs (SSRF-shaped risk)

• Error messages that leak secrets or internal hosts

Remediation mindset

Prefer allow-listed destinations, rotating secrets, and clear replay protection. Document impact as unauthorized state changes, not just “interesting traffic.”

---

Worth reading next

• Web Hacking for Pentesters: Server-Side Request Forgery (SSRF)

• API Hacking: Rate Limiting and Resource Consumption