domains / families / security / unauth-api-flow-hijack

unauth-api-flow-hijack

separate

Exploit unauthenticated multi-step API flows without credentials.

When to use

• An API serves a multi-step workflow (start → step1 → step2 → ... → complete).
• No authentication token, session cookie, or API key is required at any step.
• The API returns session identifiers (UUIDs, tokens) that can be reused across steps.
• The workflow includes file upload, data submission, or export functionality.
• Error messages reveal the expected request format (validating that endpoints are live).

When not to use

• authenticated API testing
• simple data exposure
• credential-based attacks

Skill page

Source