Summary

This chapter covered important topics on your journey toward pentesting APIs. You learned that you must begin by gathering information about the target and reconning it. After correctly identifying and enumerating the API, you learned that you must read its documentation carefully and find out which endpoints it exposes. This may reveal valuable information, as you learned. Additionally, you learned that you can make use of an extremely useful set of techniques called OSINT, which are extensively applied everywhere by forensic investigators and enthusiasts. The chapter finished with a complementary section about how API data and schema structures are important in this phase.

In the next chapter, you will learn how to explore the authentication and authorization stages more while pentesting an API. This chapter included some introduction to that topic, but we’ll go into greater depth in the next one with analysis and more tests.