diff --git a/document/4-Web_Application_Security_Testing/12-API_Testing/01-API_Reconnaissance.md b/document/4-Web_Application_Security_Testing/12-API_Testing/01-API_Reconnaissance.md index f1eca1359c..0cba1ab582 100644 --- a/document/4-Web_Application_Security_Testing/12-API_Testing/01-API_Reconnaissance.md +++ b/document/4-Web_Application_Security_Testing/12-API_Testing/01-API_Reconnaissance.md @@ -109,7 +109,7 @@ Wordlists are helpful here for a comprehensive list of common words used in APIs ### Look Back, Way Back -Published and private APIs change over time. But deprecated or older version may still be operational either on purpose or by misconfiguration. These should also be tested as there is a good chance that they will contain vulnerabilities that newer versions have fixed. In addition, changes to APIs show newer features which may be less robust and therefore a good candidate for testing. +In general APIs change over time. But deprecated or older version may still be operational either on purpose or by misconfiguration. These should also be tested as there is a good chance that they will contain vulnerabilities that newer versions have fixed. In addition, changes to APIs show newer features which may be less robust and therefore a good candidate for testing. To discover older version we can use the `Wayback machine` to help find older endpoints. A helpful tool know as TomNomNom's [WayBackUrls](https://github.com/tomnomnom/waybackurls) fetches all the URLs that the Wayback Machine knows about for a domain.