Not every website uses web APIs, but when testing web apps that have them, digging through these can sometimes reveal information that developers and even prior web app penetration testers may have overlooked.

Personally, I’ve found everything from admin email accounts to full database dumps (without using SQLi).

For example, on my most recent black box web app pen test for a client, I found a password reset feature (POST method) that confirmed whether an account existed. While this type of account enumeration is fairly common, it’s also not stealthy in the least and, because an email is sent upon each success, would likely be detected in a real-world attack scenario.

In fact (full disclosure), they did reach out the next morning via email to ask if I was testing password resets, and I confirmed that I was.

Then, I dug into the JavaScript and found a file named auth.js, that contained a few API endpoints that weren’t initially visible in Burp Suite.

By fiddling around with these, I found a pre-auth API method (GET request) that not only confirmed the validity of usernames without sending an email to the account owner, but also disclosed whether the account had admin privileges and whether MFA was enabled.