unauth-api-flow-hijack

Unauthenticated API Flow Hijack

Exploit API endpoints that implement a full business workflow (interview, application, checkout, onboarding) without requiring authentication at any step. Unlike simple data exposure, these flows allow an attacker to participate in — and manipulate — the application's core business logic: submitting forms, uploading files, completing transactions, and exporting data. The entire state machine is accessible without credentials.

When to Use

• An API serves a multi-step workflow (start → step1 → step2 → ... → complete).
• No authentication token, session cookie, or API key is required at any step.
• The API returns session identifiers (UUIDs, tokens) that can be reused across steps.
• The workflow includes file upload, data submission, or export functionality.
• Error messages reveal the expected request format (validating that endpoints are live).

Prerequisites

• terminal with curl and python3.
• Discovery of at least one API endpoint that accepts POST without authentication.
• The endpoint returns an identifier (session ID, interview ID, token) that can be passed to subsequent steps.

Quick Detection

# Probe common flow-starting endpoints
for ep in /start /api/start /api/v1/start /begin /init /api/init \
          /start-interview /api/interview/start /api/session/start; do
  code=$(curl --max-time 30 --connect-timeout 10 -sk -o /tmp/resp.json -w "%{http_code}" \
    -X POST "https://target.com$ep" \
    -H "Content-Type: application/json" -d '{}')
  if [ "$code" = "200" ] || [ "$code" = "201" ]; then
    echo "=== $ep ($code) ==="
    cat /tmp/resp.json | python3 -m json.tool 2>/dev/null | head -20
    # Extract any returned ID
    cat /tmp/resp.json | python3 -c "
import sys,json,re
try:
    d=json.load(sys.stdin)
    for k in d:
        if any(x in k.lower() for x in ['id','token','session','key']):
            print(f'{k}: {d[k]}')
except: pass
"
  fi
done

Procedure

Phase 1 — Map the Flow

Identify all steps by following the API's natural progression: