⟩ Offensive Security
REST / GRAPHQL
API Security
Hands-on testing of REST, GraphQL and gRPC APIs against OWASP API Top 10.
What I deliver
- BOLA, mass assignment, auth flaws
- GraphQL introspection abuse
- Rate-limit & business logic testing
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
GraphQL API for fintech — batched query abuse + BOLA exposed competitor portfolio data
02
Microservices REST audit — JWT alg-confusion + mass-assignment, 22 critical fixes
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
CriticalBOLA — Broken Object Level Authorization (API1)
- STEP 1Capture authenticated traffic between two tenants
- STEP 2Swap object IDs (user_id, order_id, doc_id) in requests
- STEP 3Confirm cross-tenant read/write
- STEP 4Fix: enforce per-object ACL checks server-side, never trust client IDs
02
HighMass Assignment (API6)
- STEP 1Diff API request body vs DB schema — find hidden fields (is_admin, role)
- STEP 2Add those fields to update requests and replay
- STEP 3Confirm privilege uplift or state tampering
- STEP 4Fix: allow-list DTOs, strip unknown fields, schema validation
03
MediumGraphQL Introspection + Batching Abuse
- STEP 1Run introspection to dump schema with GraphQL Voyager
- STEP 2Batch hundreds of queries / aliases in one request to bypass rate limits
- STEP 3Identify expensive resolvers → DoS or data scraping
- STEP 4Fix: disable introspection in prod, query cost analysis, depth + alias limits
04
HighBroken Function Level Authorization (API5)
- STEP 1Diff endpoints reachable by an admin role vs a low-privilege role
- STEP 2Replay admin-only requests (DELETE, bulk export, role-change) with a standard user token
- STEP 3Confirm the server accepts the action without re-checking role server-side
- STEP 4Fix: centralize authorization checks per route/method, deny-by-default, test with both roles in CI
⟩ arsenal
Tools & frameworks
Burp
Web Security
Postman
API Testing
GraphQL Voyager
GraphQL Recon
Akto
API Security
Insomnia
API Client
Kiterunner
API Discovery
ffuf
Web Fuzzing
Nuclei
Template Scanner
42Crunch
Security Tool
Schemathesis
Security Tool
⟩ engage
Need api security expertise?
⟩ related