API Recon — Mapping Every Hidden Endpoint

APIs are where the bugs (and the money) are in 2026, but you can't hack an API you can't SEE. This post is all about API recon — mapping every hidden endpoint so you have a full target list before you start testing. Miss this step and you're hunting blind.

Why API Recon Is Its Own Skill

A modern app might talk to hundreds of API endpoints. The website shows you maybe a fraction of them. The rest — old versions, internal functions, admin routes, undocumented features — are invisible unless you go looking. And those hidden ones are usually the LEAST protected, because devs assume nobody will find them.

So the goal of API recon: build the most complete map of endpoints possible, then test each one for the API bugs (BOLA, broken auth, excessive data, mass assignment — all from batch 1).

How To Discover Endpoints

1. Proxy everything. Route the app through Burp and just USE it — every button, every feature, on both web AND mobile. Every API call it makes shows up in your proxy history. This is your baseline map.

2. Read the JavaScript. JS bundles are STUFFED with endpoint paths (post 4). Tools like LinkFinder extract them automatically. This surfaces endpoints with no UI button.

3. Hunt for API docs. Try /swagger, /swagger-ui, /openapi.json, /api-docs, /redoc, /graphql. Sometimes the ENTIRE API is documented publicly — a free, complete map.

4. Version-walk. See /api/v3/? Try /api/v2/ and /api/v1/. Old versions are forgotten and under-secured but often still live.

5. Fuzz for endpoints. Use ffuf with API-specific wordlists against the API base path to find undocumented routes.

The Mobile App Goldmine

Here's a pro move: the MOBILE app is often the best source of API endpoints. Why? Mobile backends frequently expose more endpoints than the website, and mobile devs often skip the protections the web team added. Proxy the mobile app (or decompile the APK) and you'll often find a richer, softer API surface than the website ever revealed.

After You Have The Map

Once you've got your endpoint list, test each one for:

• BOLA/IDOR — swap IDs, access others' objects (the #1 API bug)
• Broken auth — does it even require a valid token? weak JWTs?
• Excessive data exposure — does the raw JSON leak more than the screen shows?
• Mass assignment — can you inject extra fields like role: admin?
• Missing rate limits — (next post!)