API-specific surfaces. See api-security for path ordering.

Discovery

• swagger-discovery · api-content-discovery
• api-endpoint-analysis

AuthN / AuthZ

• api-authentication-attacks
• bola · bfla · mass-assignment

Auth tokens

• jwt · oauth-flows · api-keys
• jwt-key-confusion · jwt-jku-jwk-injection
• saml-xsw-attacks

Protocols

• graphql-attacks · grpc-attacks
• soap-attacks · rpc-attacks

GraphQL deep dive

• graphql-source-review
• apollo-server-audit-patterns
• hasura-audit-patterns
• graphql-field-permissions-introspection
• graphql-persisted-query-bypass

Bug classes

• cross-api-scripting-xas
• api-unsafe-consumption
• api-business-flow-abuse

Methodology

• api-threat-modeling · api-fuzzing-wide-vs-deep

Abuse and evasion

• rate-limit-bypass · api-evasion-techniques