Methodology

1

API reconnaisance

• Google dorking/hacking

intitle:"index of" inurl:"api*"

intitle:"index of" inurl:"/api/v1"
intitle:"index of" inurl:"/api/v2"
...

• Fuzzing with wordlists

$ wfuzz ...

2