APIHunter

🛰️ Comprehensive API Discovery & Security Testing

Find hidden APIs, fingerprint authentication models, and surface IDOR, mass assignment, GraphQL, CORS, and HTTP smuggling vulnerabilities — built for bug bounty hunters, red teamers, and security researchers.

📖 About

APIHunter is a comprehensive API discovery and security testing tool written in Go. It extracts endpoints from JavaScript bundles, OpenAPI/Swagger specs, Android APKs, HAR captures, and live crawling — then runs targeted security checks (IDOR, auth bypass, mass assignment, rate limiting, GraphQL introspection, CORS misconfiguration, HTTP smuggling, OpenAPI mismatch) against everything it finds.

APIHunter — discover APIs, fingerprint them, scan them.

---

📑 Table of Contents

• About
• Features
• Installation
• Quick Start
• Usage Examples
• Command Reference
• Advanced Usage
• Contributing
• License
• Support

---

✨ Features

🎯 Core Capabilities

• 🔍 Multi-Source API Discovery: JavaScript (AST + regex), OpenAPI v2/v3, Android APK, HAR traffic, live crawling
• 🔐 Authentication Fingerprinting: Bearer tokens, API keys, session cookies — plus role separation (admin/user/public)
• 🛡️ Eight Security Check Classes: IDOR, auth bypass, mass assignment, rate limiting, GraphQL, CORS, HTTP smuggling, OpenAPI mismatch
• ⚡ High-Performance Scanning: Concurrent worker pools with configurable rate limiting and timeouts
• 🎭 Stealth Operations: Proxy support, custom workers, deliberate request pacing for sensitive engagements

🧠 Intelligent Discovery Engine

Pull APIs from where they actually live — JS bundles, mobile apps, traffic captures, and docs.

• 🎯 AST-Based JavaScript Parsing: Catches fetch(), axios, XMLHttpRequest, GraphQL queries that regex misses
• 🏢 Mobile App Extraction: Pull endpoints directly from Android APK files
• 🧠 Versioning Detection: Identifies API versions in paths, headers, or query parameters
• 📊 Environment Leak Detection: Surfaces dev, staging, and production environments in discovered endpoints

🔐 Security Scanning Suite

Eight check classes that map to real bug bounty payouts

Authorization & Access:

• 🔑 IDOR Detection (--idor): Insecure direct object reference checks across discovered endpoints
• 🎫 Auth Bypass (--auth): Missing or optional authentication on protected routes
• 🔥 Mass Assignment (--mass): Extra JSON field acceptance for privilege escalation

Rate & Volume:

• ⏱️ Rate Limiting (--rate): Burst and token-based rate limit tests
• 📋 GraphQL (--graphql): Introspection enabled, missing depth limits, batched query abuse
• 🛡️ CORS (--cors): Wildcard origins, credentialed wildcard misconfigurations

Protocol-Level:

• 🔗 HTTP Smuggling (--smuggle): Header confusion vulnerability checks
• 📊 OpenAPI Mismatch (--openapi-mismatch): Documentation vs reality comparison for shadow endpoints

🎯 Pro tip: Combine multiple checks for maximum coverage — apihunter scan -u target --js --idor --auth --rate --graphql --cors

🌐 HTTP & Networking

Production-grade HTTP layer

• 🔗 Proxy Support (--proxy): Burp Suite and other intercepting proxies
• ⚡ Concurrent Workers (--workers): Tunable worker pool, default 50
• ⏱️ Rate Limiting (--rate-limit): Requests per second cap
• ⏰ Custom Timeouts (--timeout): Per-request timeout tuning
• 🎭 Stealth Mode (--stealth): Slower, randomized pacing
• 🔧 Auth Tokens (--auth-token): Bearer / API key headers for authenticated scans

📤 Output & Reporting

Three formats for three audiences

• 🖥️ Table (default): Color-coded console output
• 📊 JSON (--format json): Machine-readable for automation pipelines
• 🔴 Burp Suite Export: Direct import for manual follow-up testing

---

📦 Installation

Go Install (Recommended)

go install -v github.com/cc1a2b/APIHunter/cmd/apihunter@latest
apihunter --help

Build from Source

git clone https://github.com/cc1a2b/APIHunter.git
cd APIHunter
go build -o apihunter ./cmd/apihunter

Binary Releases

Download pre-built binaries from the Releases page.

System Requirements

• Go 1.21+ (for building from source)
• Linux, macOS, or Windows (64-bit)
• Network access to the target

---

🚀 Quick Start

Extract APIs from JavaScript

apihunter extract --js https://target.com/app.js -o endpoints.json

Extract from OpenAPI / HAR

apihunter extract --openapi swagger.json -o endpoints.json
apihunter extract --har traffic.har    -o endpoints.json

Run a full security scan

apihunter scan \
  -u https://api.target.com \
  --js \
  --idor --auth --rate \
  -o report.json

---

💡 Usage Examples

# Basic discovery and scan
apihunter scan -u https://api.target.com --js --idor --auth --rate -o report.json

# Authenticated scan
apihunter scan \
  -u https://api.target.com \
  --auth-token "Bearer eyJ..." \
  --idor --mass \
  -o report.json

# Multi-target sweep
apihunter scan \
  -l targets.txt \
  --graphql --cors \
  -o report.json

# Stealth scan through Burp
apihunter scan \
  -u https://api.target.com \
  --js --idor --auth --rate --graphql --cors \
  --stealth \
  --proxy http://127.0.0.1:8080 \
  --workers 50 \
  --rate-limit 10 \
  --timeout 8s \
  --format json \
  -o report.json

# Mobile app endpoint extraction
apihunter extract --apk app.apk -o mobile-endpoints.json

---

📋 Command Reference

Usage:
  apihunter <command> [flags]

Commands:
  extract          Pull endpoints from a source without scanning
  scan             Discover + scan target(s)
  version          Show version

Input Sources:
  -u, --url URL                  Target URL
  -l, --targets-file FILE        File of target URLs
      --js                       Extract from JavaScript bundles
      --openapi FILE             Parse OpenAPI v2/v3 spec
      --har FILE                 Parse HAR traffic capture
      --apk FILE                 Extract from Android APK

Security Checks:
      --idor                     IDOR detection
      --auth                     Auth bypass detection
      --mass                     Mass assignment detection
      --rate                     Rate limiting tests
      --graphql                  GraphQL introspection + depth tests
      --cors                     CORS misconfiguration checks
      --smuggle                  HTTP smuggling header confusion
      --openapi-mismatch         Compare OpenAPI vs live behaviour

HTTP & Performance:
      --auth-token TOKEN         Authorization header value
      --workers INT              Concurrent worker pool (default: 50)
      --rate-limit INT           Max requests per second
      --timeout DUR              Per-request timeout (e.g. 8s)
      --proxy URL                HTTP/HTTPS/SOCKS proxy
      --stealth                  Slower, evasive scanning

Output:
      --format FMT               table | json | burp
  -o, --output FILE              Output path
  -v, --verbose                  Detailed output
  -h, --help                     Show help

---

🔧 Advanced Usage

Bug Bounty Workflow

# 1. Discover everything
apihunter extract --js https://target.com/app.js -o js-apis.json
apihunter extract --har capture.har -o har-apis.json

# 2. Scan the merged set with full check suite
apihunter scan -l discovered.txt \
  --idor --auth --mass --rate --graphql --cors --smuggle --openapi-mismatch \
  --proxy http://127.0.0.1:8080 \
  --workers 30 --rate-limit 5 \
  -o full-report.json

# 3. Re-run only IDOR with elevated auth tokens
apihunter scan -l discovered.txt \
  --idor --auth-token "Bearer $LOW_PRIV_TOKEN" \
  -o idor-report.json

CI / Continuous Discovery

# Nightly scan on merge to main
apihunter scan -u https://api.staging.example.com \
  --js --openapi-mismatch --cors --rate \
  --format json -o "scan-$(date +%F).json"

---

🤝 Contributing

Contributions welcome.

• 🐛 Report bugs via GitHub Issues
• 💡 Suggest features or new check classes
• 📝 Improve documentation
• 🔧 Submit pull requests with new extractors or detectors

Development Setup

git clone https://github.com/cc1a2b/APIHunter.git
cd APIHunter
go mod tidy
go build -o apihunter ./cmd/apihunter

---

📄 License

APIHunter is released under the MIT License. See LICENSE for details.

Copyright (c) 2025-2026 Hussain Alsharman
Licensed under MIT License — free for commercial and personal use

---

☕ Support

If APIHunter helps with your security research:

⭐ Star this repo • 🐦 Follow @cc1a2b • 📢 Share with the security community

---

🛰️ APIHunter — Comprehensive API Discovery & Security Testing

Built with ❤️ by cc1a2b for the security community