████   ███  ████    ███  ███  █   █   
█░░░█ █ ░░█ █░░░█    █░░█ ░░█  █ █ ░  
████░░█░ ░█░█░░░█░   █░░█░ ░█░  █ ░ ░ 
█░░░█ █░░ █░█░░ █░█  █░░█░░ █░░█ █ ░  
████░░ ███ ░████ ░░██ ░░ ███ ░█ ░ █   
 ░░░░ ░ ░░░ ░░░░░ ░ ░░ ░  ░░░ ░░ ░ ░  
  ░░░░   ░░░  ░░░░   ░░    ░░░  ░   ░  

🦊 APIthief

REST/GraphQL API Parameter Discovery + Auth Bypass Testing

Discover hidden API endpoints, enumerate parameters, test authorization bypass techniques, and enumerate GraphQL schemas — all for free with zero configuration.

⚡ Quick Start

git clone https://github.com/b0dj0x/APIthief
cd APIthief
pip install -r requirements.txt
python3 apithief.py https://target.com

🧰 Usage

# Full scan — all modules
python3 apithief.py https://target.com --all

# Endpoint discovery only
python3 apithief.py https://target.com --endpoints

# Discover API documentation (Swagger, OpenAPI)
python3 apithief.py https://target.com --docs

# Parameter discovery on specific endpoint
python3 apithief.py https://target.com --params /api/v1/users

# Auth bypass testing
python3 apithief.py https://target.com --auth /api/v1/admin

# HTTP method testing
python3 apithief.py https://target.com --methods /api/v1/users

# GraphQL enumeration
python3 apithief.py https://target.com --graphql

# With auth headers
python3 apithief.py https://target.com --auth /admin -H "Authorization: Bearer token123"

# Multi-threaded scan
python3 apithief.py https://target.com --endpoints --threads 50

# Export results to JSON
python3 apithief.py https://target.com --all --export results.json

🎯 Features

Module	Description
Endpoint Discovery	160+ API paths, GraphQL endpoints, REST versions
API Docs Discovery	Swagger, OpenAPI, GraphiQL, Redoc, Actuator
Parameter Discovery	60+ parameters via GET query + POST body
Auth Bypass Testing	21 techniques: empty tokens, JWT none, basic auth, IP spoofing, cookies
HTTP Method Testing	GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
GraphQL Enumeration	Introspection, typenames, queries, mutations, GET bypass
JSON Export	Full results export for integration

🛡️ Auth Bypass Techniques

#	Technique	Description
1	No Auth	Request without any headers
2	Empty Bearer	Authorization: Bearer
3	Null Token	Authorization: Bearer null
4	Undefined	Authorization: Bearer undefined
5	Admin Token	Authorization: Bearer admin
6	JWT None	Algorithm-none JWT bypass
7	Basic Admin	Basic YWRtaW46YWRtaW4=
8	X-API-Key	Custom API key header
9	Cookie Admin	Session/role cookies
10	X-Forwarded-For	IP spoofing via headers
11	X-Real-IP	Real IP header bypass
12	X-Original-URL	URL rewrite bypass
+	9 more	Additional techniques

📊 Sample Output

  Target: https://target.com

  Discovering API endpoints...           Discovered Endpoints (12)
  ┌────┬─────────────────────┬────────┬─────────┐
  │ #  │ Path                │ Status │ Methods │
  ├────┼─────────────────────┼────────┼─────────┤
  │ 1  │ /api/v1/users       │ 200    │ GET     │
  │ 2  │ /graphql            │ 200    │ GET     │
  │ 3  │ /api/docs           │ 200    │ GET     │
  │ 4  │ /admin              │ 403    │ GET     │
  │ 5  │ /health             │ 200    │ GET     │
  └────┴─────────────────────┴────────┴─────────┘

  Testing auth bypass on /admin...       Auth Bypass Test: /admin
  ┌──────────────────┬────────┬──────────┐
  │ Technique        │ Status │ Bypassed │
  ├──────────────────┼────────┼──────────┤
  │ x_forwarded_for  │ 200    │ YES      │
  │ cookie_admin     │ 200    │ YES      │
  └──────────────────┴────────┴──────────┘

  Scan Summary
  ┌──────────────────────┬───────┐
  │ Metric               │ Value │
  ├──────────────────────┼───────┤
  │ Endpoints Found      │ 12    │
  │ API Docs Found       │ 2     │
  │ Parameters Found     │ 8     │
  │ Auth Bypasses        │ 2     │
  └──────────────────────┴───────┘

⚠️ Disclaimer

This tool is for authorized security testing only. Only use on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.

📜 License

MIT License - see LICENSE for details.

---

Made by b0dj0x · https://b0dj0x.cc