its Exist Person | Blog

Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks By Security Research Team | Intermediate TL;DR: Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses. #blog 1. IDOR (Insecure Direct Object Reference) GET /api/v1/users/profile?user_id=12345 HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIs... # Attacker modifies: GET /api/v1/users/profile?user_id=12346 HTTP/1.1 # If server returns user 12346's data without checking ownership: IDOR! 2. JWT Attacks Attack Method alg=none Change alg to none , remove signature Weak HMAC secret hashcat -m 16500 jwt.txt rockyou.txt JWK injection Insert jwk header with attacker's public key KID injection Set kid: ../../dev/null to bypass verification 3. GraphQL Introspection query { __schema { types { name fields { name } } } } 4. Rate Limiting & OTP Brutefo...

Web Exploitation for Mobile: API Hacking, IDOR & JWT Attacks By Security Research Team | Intermediate TL;DR: #app Mobile apps communicate exclusively through APIs, making them highly susceptible to web-level attacks. We cover IDOR, JWT manipulation, mass assignment, GraphQL introspection, and rate-limiting bypasses. 1. IDOR (Insecure Direct Object Reference) The #1 vulnerability in mobile APIs. The app sends a user ID or resource ID in the request, and the server fails to verify ownership. GET /api/v1/users/profile?user_id=12345 HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIs... # Attacker modifies: GET /api/v1/users/profile?user_id=12346 HTTP/1.1 # If server returns user 12346's data without checking JWT ownership: IDOR! 2. JWT Attacks Attack Method alg=none Change alg to none , remove signature Weak HMAC secret hashcat -m 16500 jwt.txt rockyou.txt JWK injection Insert jwk header with attacker's public key KID injection Set kid: ../../dev/null to by...