api-noauth-hunt

1# API No-Authentication Validation
2 
3Identify API operations that may be reachable without the authentication or
4authorization required by their data and business function. Discovery is
5read-only by default. Write validation uses synthetic records and requires
6explicit authorization immediately before execution.
7 
8## When to Use
9 
10- Port scan reveals HTTP services on non-standard ports (3000, 5000, 8080-8085, 9000).
11- Target has an API subdomain (api.target.com, backend.target.com).
12- JavaScript bundles reference internal API endpoints.
13- After `port-service-discovery` finds HTTP on unexpected ports.
14- After `hunt-firebase` or `hunt-supabase` identifies backend APIs.
15 
16## Prerequisites
17 
18- curl, python3, jq installed.
19- Target URL or IP:port of the suspected API.
20- List of common API paths for fuzzing.
21 
22## How to Run
23 
24```bash
25# Quick API test — try common paths without auth
26TARGET="https://api.target.com"
27for path in "/" "/api" "/api/v1" "/api/users" "/api/health" "/docs" "/swagger.json"; do
28  code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 "$TARGET$path")
29  echo "HTTP $code: $TARGET$path"
30done
31```
32 
33## Quick Reference
34 
35| Signal | What It Means | Action |
36|--------|---------------|--------|
37| HTTP 200 on `/api/users` or `/api/clients` | Possible unauthenticated data access | Validate one bounded sample |
38| HTTP 2xx on POST without auth | Possible unauthenticated write | Stop and obtain write authorization |
39…