Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks

By Security Research Team | Intermediate

TL;DR: Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses. #blog

1. IDOR (Insecure Direct Object Reference)

GET /api/v1/users/profile?user_id=12345 HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

# Attacker modifies:
GET /api/v1/users/profile?user_id=12346 HTTP/1.1
# If server returns user 12346's data without checking ownership: IDOR!

2. JWT Attacks

Attack	Method
alg=none	Change alg to none, remove signature
Weak HMAC secret	hashcat -m 16500 jwt.txt rockyou.txt
JWK injection	Insert jwk header with attacker's public key
KID injection	Set kid: ../../dev/null to bypass verification

3. GraphQL Introspection

query { __schema { types { name fields { name } } } }

4. Rate Limiting & OTP Bruteforce

Mobile login endpoints often have no rate limiting, enabling OTP bruteforce (4-6 digit codes), credential stuffing, and password spraying.

---

Defense Checklist

• Authorization check on every resource access, not just authentication
• Use RS256 JWT with short expiry (15 min), refresh tokens in HttpOnly cookies
• Whitelist fields for mass assignment (use DTOs, not domain models)
• Disable GraphQL introspection in production
• Rate limit by user ID + IP + device fingerprint, not IP alone

Tags: #API_Hacking #IDOR #JWT #GraphQL #BugBounty