With a wordlist from something like cewl, what do you usually use to mix-match & generate more words?

What do you think I can do if a domain has *.googlemail.com & *.google.com MX records?

@JohnZhau You can send emails to this domain.

Nothing special about it huh

There's something confusing about Java. The latest version seems to be 14, but that's JDK (development kit, which should include the runtime environment too). If you just want the JRE runtime environment, you need to scroll the page until you see JRE version 8 ( oracle.com/java/technologies/javase-downloads.html ). It feels like you are going to install an old version of Java

And if you google "java for windows" or anything like that, the first results are from java.com, a site that "apparently" in legitimate, but it looks so bad, so old-style, that it even feels like a fake website. BTW, the version to download there is 8, again.

I am convinced that good UX, just like INFOSEC, is something that costs a lot and nobody is willing to pay for.

@reed This is 100% true. If I had a dollar for everytime I got turned off a product because of a poor UX...

It got worse for Java: you now have to create an Oracle account to download the JRE. It's like they want people to stop using Java.

I think they really want "regular" people (non developers) to avoid installing the JRE on their computer. They seem to be focusing on the server market and dropping the desktop market. Maybe acknowledging they lost against .NET.

@A.Hersean, yes, I noticed that on oracle.com an account is required, and they ask you lots of required data (name, phone, address, where you work, etc.). I downloaded it from java.com though, then checked the checksums, they match those I have found on oracle.com (after googling them)

Java is still #2 on TIOBE index, FWIW

How do you identify API end points? Does it usually need to have /api/ in the URL? Would something with a ?param=value query that is likely processed by the backend (retrieve an article with an ID) be an API?

@JohnZhau an API is an interface for programming, and it's defined by its purpose, not its "form". It can have any form or shape or parameters or URL or whatever.

So if it seems like the ?= queries are handled by the back-end, I can probably test for common API vulns right?

What if the site is not (yet) made to be used by programmers? There's no explicit API, but something that behaves like an API? May be something like example.com/articles?id=123&session_id=456 where the article with id=123 is retrieve & served by the server. In that case, I can fuzz session_id and do tests like I would an API, right?

Your example is an API.

An API most likely without documentation or design guidelines. An ad-hoc API. But an API nonetheless.

How would you define "API"? From what I've learned, it's usually something made to be used by programmers with automation & often have a /api/ in the URL.

More specifically, it's a web API, because accessible over HTTP(S) and over internet.

API = application programming interface

It's a very large concept

Wikipedia is your friend

I know that term, but in my example, it likely isn't made to be used for automation by programmers

I'm reading about what APIs are

there's no "automation" in "application programming interface"

I'm trying to identify some APIs

for API testing

When booking a room in an hotel, you can use a web API to request a room, and a human might have to validate the request, maybe process special accommodations requests by the (human) client, then the response from the API request could be available hours later

From what I've just learned, an API is an interface for communication between processes.

Yes, but:

So when I go to example.com/news, that's accessing the root API?

example.com/news?id=123 would be accessing the /news/ API?

@JohnZhau what is a "root" API? What does that even mean?

API at the root of the site instead of at /news/?

sorry I'm getting some vocab mixed up

You are confusing "API" and "textbook REST API"

I haven't studied specific APIs before. I've just looked at examples of API testing and stuff

You might be learning simplified stuff with simplified concepts. That's needed in the learning process, before going to more complex stuff. But do not confuse the over simplifications you are learning (which are very clean examples) with the messy complex reality

Can you give me examples of what APIs would often look like?

define "often"

Well stuff you see a lot?

like "typical RESTful APIs"

or "If I see this, it's like;y an API end-point"

Look for big names. For example: dropbox.com/developers/documentation/http/documentation

That's if you want well designed APIs. Good examples to follow.

If you're hired to test a webapp (white/gray box), how may you ask the devs what kind of API they use?

They have a lot of users. But they are a minority in the world of APIs. Most API are a mess.

@JohnZhau This question does not make any sense.

A developer use the API they need for the job.

Sorry I'm just very new to API testing. I'm trying to learn how APIs work.

When making its own API, a developer does the API they can, in limited time, resource, experience, etc.

A developer might want to build the perfect API. But one cannot have "perfect", "cheap" and "fast to develop". So one of those needs to be dropped. Only big companies can afford to make good APIs, because they have money to spare.

Off-topic: How often do you, in a test, find something in the server/app (built-in, not malware) that the devs didn't even know was there?

always

Always? how

copy-paste from stackoverflow usually leads to example code included where it shouldn't be

oh

noice

You never develop something from scratch. Your code or development process always depends on the work of others. Nobody has the time to check dependencies.

importing code from github and ending up with methods on the class that was used to debug, to teach something, things like that

but somehow the encrypt-and-compress have a dump_privkey, or something like that... and devs will ship it together

and you exploit those a lot?

I don't... I am on the other side... I secure infrastructure against attackers, I am not on the software exploitation arena...

but lots of people do... knowing the libs used are a good point to start poking around