Apex-C: API Vulnerability Hunter

• 

  Detection of sensitive data exposure and potential security weaknesses

• 

  Automated fuzzing engine testing multiple API endpoints for vulnerabilities

• 

  Extracted API endpoints and authentication token from live session

🚀 Inspiration

Modern applications rely heavily on APIs, but many suffer from hidden vulnerabilities like broken authorization and insecure endpoints. I wanted to build a tool that can automatically discover and test these weaknesses in real-world systems.

🛠 What it does

Apex-C is an automated API security testing engine that:

• Discovers hidden/private API endpoints
• Uses authenticated sessions to test real user flows
• Performs fuzzing to detect vulnerabilities like IDOR, privilege escalation, and KYC bypass
• Identifies sensitive data exposure in API responses

⚙️ How I built it

I built Apex-C using Python with Selenium and undetected-chromedriver to simulate real user sessions. The engine:

• Captures session tokens after login
• Crawls application endpoints dynamically
• Sends crafted payloads across multiple HTTP methods (GET, POST, PUT, PATCH, DELETE)
• Analyzes responses for sensitive data and anomalies

🧪 Challenges I ran into

• Bypassing bot detection and anti-automation systems
• Handling dynamic API endpoints and tokens
• Avoiding false positives during fuzzing
• Managing session-based authentication securely

🏆 Accomplishments that I'm proud of

• Successfully built a working automated API vulnerability scanner
• Implemented intelligent endpoint discovery
• Created a flexible fuzzing engine for multiple attack scenarios
• Generated real-time logs for security analysis

📚 What I learned

• Deep understanding of API security and backend vulnerabilities
• How authentication tokens and sessions work in modern apps
• Practical techniques for fuzzing and testing APIs
• Importance of responsible security research

🔮 What's next for Apex-C

• Add AI-based vulnerability detection
• Improve accuracy and reduce false positives
• Build a user-friendly dashboard
• Extend support for more platforms and APIs

Built With

• automation-testing
• chrome-devtools
• fuzzing
• javascript
• json
• python
• rest-apis
• selenium
• undetected-chromedriver
• web-security