Summary

In this practical chapter, we looked at how error messages that are thrown by API endpoints when handling requests can be useful not only to reveal information about their environment and configurations (data leakage) but also to cause more damage, such as DoS attacks (when the endpoint can’t heal itself after receiving an aggressive payload). We got our hands dirty with mutation and fuzzing and leveraged them in an exercise to bomb an API endpoint with bizarre data.

In the next chapter, we will get knee-deep in terms of DoS attacks and rate-limiting testing. Some APIs are protected by control mechanisms that reduce the number of requests a client can set at once. However, there are some techniques we can leverage to increase the chances of a successful attack.