Summary
This chapter took us on a complete journey from zero knowledge of a target right through to being able to determine the version of the database used. The passive reconnaissance techniques principally used Google and the query operators, as well as the Shodan database, to determine a range of likely candidate targets for exploration.
We learned how to use active reconnaissance to actively focus on the API implementations on the hosts by examining their behavior under live probing using nmap or Massscan, while OWASP ZAP can provide a wealth of insight using spider scanning. Finally, we learned how to use information leakage to gain insight into the inner details of the implementation, allowing us to understand details such as the host OS and database.
By conducting a thorough discovery phase, you will have placed yourself in a perfect position to move on to the final chapter in the section—on attacking APIs.
