Active discovery

We will now look at various techniques for the active discovery of APIs in the real world. By active, we mean that we will interact with the API and/or its network by monitoring the traffic or directly accessing the API or its host.

Note – ensure that you have permission to access the computing resources

The use of active discovery using the tools and techniques described in this section may be against the terms and conditions of use of various services, ranging from your ISP to the relevant cloud hosting service. If you are unsure whether you are authorized to perform such scanning, you should err on the side of caution and seek explicit permission. In many cases, such scanning may also be against the applicable laws within your country, and any violations may have serious consequences. Fortunately, many of the scenarios described can easily be recreated in a laboratory environment that is totally under your control.

Network discovery and scan

Typically...