Listen to this Post
Introduction
In bug bounty hunting, discovering a vulnerability on a single endpoint often leads testers to stop too soon. The real game‑changer is the simple yet powerful tip: “Check other endpoints related to the same functionality.” When an application exposes multiple endpoints that perform similar operations—such as user profile updates, file uploads, or data retrieval—they frequently share code, logic, and security flaws. Expanding your test scope to include these related endpoints can turn a low‑impact finding into a critical chain of exploits, significantly increasing severity and reward.
Learning Objectives
- Understand how to identify and map relationships between endpoints in a web application.
- Learn practical techniques to enumerate hidden endpoints using both manual and automated methods.
- Apply step‑by‑step testing strategies to uncover common vulnerabilities (IDOR, SQLi, broken authentication) across related endpoints.
- Implement mitigation measures to help developers secure all endpoints consistently.
You Should Know
1. Mapping the Endpoint Landscape
Before testing related endpoints, you must discover them. Start with the functionality you already have—for example, a profile update endpoint like `https://target.com/api/user/update`. Look for other endpoints that handle similar data.
Step‑by‑step guide
- Use Burp Suite’s Site Map – Interact with the application while Burp records all requests. Review the site map for patterns (e.g.,
/api/user/,/api/admin/). - Extract from JavaScript files – Modern SPAs often embed API routes in JS.
– Linux: `grep -r “api” /path/to/js/`
– Windows (PowerShell): `Get-ChildItem -Recurse -Filter .js | Select-String “api”`
3. Leverage historical data – Use tools like `waybackurls` or `gau` to fetch archived URLs.
waybackurls target.com | grep -E "api|v1|rest|graphql" | sort -u > endpoints.txt
4. Crawl with tools – Run a crawler like `Katana` or `Feroxbuster` to enumerate all accessible paths.
feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/common.txt
2. Fuzzing for Hidden Endpoints and Parameters
Once you have a baseline, fuzz for undocumented endpoints that might share the same logic. For instance, if `/api/user/update` exists, try /api/admin/update, /api/user/updateV2, or /api/user/modify.
Step‑by‑step guide
- Use `ffuf` with a custom wordlist of common endpoint names (e.g.,
update,edit,change,modify).ffuf -u https://target.com/api/user/FUZZ -w ./endpoint-names.txt -mc 200,403 -fs 1234
- Fuzz for parameters across endpoints. The same parameter name might be reused. Use
arjun:arjun -u https://target.com/api/user/update -m GET
- For Windows, use `Invoke-WebRequest` in a loop:
$wordlist = Get-Content .\endpoint-names.txt foreach ($word in $wordlist) { try { $r = Invoke-WebRequest "https://target.com/api/user/$word" -Method GET; Write-Host "$word : $($r.StatusCode)" } catch {} }
3. Testing for IDOR Across Related Endpoints
Insecure Direct Object References often appear when endpoints handle object IDs inconsistently. If one endpoint lacks proper authorization, its related siblings might also be vulnerable.
Step‑by‑step guide
- Capture a valid request for a known endpoint (e.g.,
GET /api/user/123/profile). - Replace the ID with another user’s ID (e.g.,
124) and see if data is leaked. - Now test other endpoints that use the same object type:
– `GET /api/user/123/orders`
– `POST /api/user/123/update`
– `DELETE /api/user/123/avatar`
4. Automate with a script:
for id in {124..130}; do
curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer <token>" "https://target.com/api/user/$id/profile"
done
5. On Windows, use PowerShell’s `Invoke-RestMethod` similarly.
4. Parameter Pollution and Injection Vulnerabilities
If one endpoint is vulnerable to SQLi or NoSQLi, related endpoints that reuse the same database query patterns are likely vulnerable too.
Step‑by‑step guide
- Confirm SQLi on a base endpoint using a payload like
' OR 1=1--. - List all endpoints that accept similar parameters (e.g.,
username,email). - Use `sqlmap` to automate testing across multiple endpoints by saving requests:
sqlmap -r request1.txt --batch --dbs sqlmap -r request2.txt --batch --dbs
- For API endpoints, try injecting into JSON parameters:
{ "username": "admin' OR '1'='1" } - If you find a time‑based blind SQLi on one endpoint, test the same payload on others—chances are the code is copied.
5. Chaining Authentication and Authorization Flaws
Sometimes related endpoints enforce different authentication mechanisms. For example, a user‑facing endpoint may use JWT, while an admin endpoint might rely on a weaker cookie. Testing across them can reveal privilege escalation.
Step‑by‑step guide
- Identify endpoints that appear to be for different roles (e.g., `/api/user/…` vs
/api/admin/...). - Try accessing the admin endpoint with a user token. If it fails, look for any alternative endpoint with similar functionality:
– `/api/admin/dashboard` vs `/api/user/dashboard` - Use tools like `jwt_tool` to tamper with tokens:
python3 jwt_tool.py <JWT> -T
- Test for missing authorization checks by sending requests with modified HTTP methods (e.g., `PUT` instead of
GET) on related endpoints.
6. Automating Endpoint Relationship Testing
Manual testing is essential, but automation helps cover ground. Build a simple bash script that takes a base URL and a list of related paths, then tests each for common issues.
Step‑by‑step guide
- Create a wordlist of related endpoint names (e.g.,
profile-update.txt):update edit change modify save patch
- Use a loop to test each endpoint with a common payload:
!/bin/bash base="https://target.com/api/user" while read endpoint; do curl -X POST "$base/$endpoint" -d '{"user_id":"123","new_email":"[email protected]"}' -H "Content-Type: application/json" -w " $endpoint: %{http_code}\n" done < profile-update.txt - Analyze responses for anomalies (e.g., 200 vs 403, or different response lengths).
4. On Windows, a PowerShell equivalent:
$base = "https://target.com/api/user"
Get-Content .\profile-update.txt | ForEach-Object {
$endpoint = $_
try {
$r = Invoke-WebRequest -Uri "$base/$endpoint" -Method POST -Body '{"user_id":"123","new_email":"[email protected]"}' -ContentType "application/json"
Write-Host "$endpoint : $($r.StatusCode)"
} catch { Write-Host "$endpoint : Error" }
}
7. Mitigation: Consistent Security Controls
For developers, ensuring that all related endpoints enforce the same security checks is crucial. This section provides hardening steps.
Step‑by‑step guide
- Centralize authorization logic – Use middleware that applies to all routes under a common path.
– Node.js (Express):
router.use('/api/', authorize); // applies to all /api endpoints
2. Automated endpoint inventory – Maintain a Swagger/OpenAPI spec and validate that all documented endpoints exist and are tested.
3. Run regular security scans – Tools like OWASP ZAP can crawl and compare security headers and responses across endpoints.
4. Conduct code reviews – Look for copy‑pasted code blocks; ensure each endpoint’s logic is reviewed for vulnerabilities.
5. Use static analysis – SAST tools can detect when similar code patterns are used across different endpoints, flagging potential flaw propagation.
What Undercode Say
- Key Takeaway 1: The low‑hanging fruit in bug bounty is often not a single endpoint, but the relationships between them. Testing related endpoints can expose systemic vulnerabilities that lead to higher severity ratings.
- Key Takeaway 2: Automation accelerates discovery, but human intuition is needed to recognize business logic that ties endpoints together—such as “user” and “admin” versions of the same feature.
- Analysis: In today’s microservices architectures, endpoints are rarely isolated. Code reuse, shared databases, and identical business logic create a web of dependencies. Attackers who map these relationships can exploit one weak link to compromise an entire feature set. For defenders, this means shifting from endpoint‑centric security to functionality‑centric security: every endpoint that implements a given function must be hardened equally. The bug hunting community’s emphasis on “related endpoints” is not just a tip—it’s a fundamental shift in how we approach application security.
Prediction
As API ecosystems grow more complex, automated tools will increasingly incorporate relationship mapping to discover hidden endpoints and test them in context. Machine learning models trained on codebases may soon predict which endpoints are likely to share vulnerabilities. However, the creative chaining of seemingly unrelated functions will remain a human‑driven art, ensuring that bug bounty hunters who master endpoint relationships will continue to uncover high‑severity flaws for years to come.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: R4jv33r Bugbounty – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
