Inspired by this question: How to approach API testing.

The first point of a checklist in the above question is "API Endpoints".

But, what to do when you don't have the endpoints documented because either the developers don't have the time to do it or it is a legacy project with unexisting documentation or such?

Do you need to guess the endpoints or examine the network traffic to discover them or is there another way?


If you have no endpoint documentation then the things are really bad. I would use the following aproach:

  • examine known clients which use the api
  • extract all possible invokations which the client can do
  • guess what is the client missing but might be supported by server like if you have order/create then there is a chance the server has order/update as well
  • guess what could be the meaning of data that is sent to the api
  • guess data types and ranges which are implied
  • prepared the tests basing on this guess

Or if you have server code

  • examine server code to extract api

Or if you have server binary

  • decompile binary
  • extract api from decompiled code

you can use tools like owasp zap to find all the api calls . It spiders through most of the endpoints in search of security vulnerabilities.


Read about different scans:




  • That looks nice. Is it legal? :) – Mate Mrše Nov 19 '19 at 13:35
  • @MateMrše it depends on the test artifact and the testers scope of work. Spider scan is passive scan and does not actually attack the end point so you are mostly safe to use it. But stay away from active scan, because passive scan is just finding possible vulnerable end points and active scan is actually attacking the endpoints to verify the identified vulnerability – PDHide Nov 19 '19 at 13:37
  • Have you had the experience of usage of such tools? Can you explain in couple of words how it can find endpoints we do not know about? – Alexey R. Nov 19 '19 at 13:46
  • 1
    I used it for webapi , just install the application and provide the web index url. Eg: www.home.com/ . It will go through all the endpoints like www.home.com/user , www.home.com/page2 bla bla and reports vulnerabilities in it. – PDHide Nov 19 '19 at 13:56
  • Give url and click start scan , – PDHide Nov 19 '19 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.