API Reconnaissance and Information Gathering
Knowing the terrain before committing to attacking it is a military maxim. Sun Tzu, the famous author of the bestseller The Art of War wrote that “you should have a strong sense of the surrounding terrain.” Getting to know the target API is as important as deleting the intrusion evidence of the attack. So, know before you go!
API reconnaissance and information gathering is the process of collecting information about an API, such as its endpoints, methods, parameters, authentication mechanisms, and business purpose. This information can then be used to identify security weaknesses, test the API’s functionality, or develop new applications that interact with the API.
In this chapter, you will learn reconnaissance and information-gathering techniques that will become part of the planning activities of a penetration test. As a matter of fact, after correctly setting up your toolbelt, as you did in the previous chapter...
