pentest-web-api

name	pentest-web-api
description	Web application and REST/GraphQL API penetration testing using OWASP WSTG, ASVS and API Top 10. Use when the user mentions web pentest, API test, BOLA, IDOR, BFLA, mass assignment, SQLi, XSS, SSRF, SSTI, CSRF, JWT, OAuth, OIDC, SAML, GraphQL introspection, file-upload abuse, deserialization, or any WSTG-* / API:2023-* identifier.

Pentest — Web Application & API

Apply the methodology in the pentest-templates library when conducting web/API tests.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Phase content lives in 01-web-api/. Read 00-overview.md first, then walk numbered files in order.

Phase order

1. 01-web-api/01-information-gathering.md — recon, fingerprinting, attack-surface map.
2. 01-web-api/02-configuration-deployment.md — server config, headers, cloud storage, subdomain takeover.
3. 01-web-api/03-identity-management.md — registration, enumeration, provisioning.
4. 01-web-api/04-authentication.md — login, MFA, password policy, JWT, OAuth, SAML.
5. 01-web-api/05-authorization.md — RBAC, IDOR/BOLA, BFLA, BOPLA, traversal.
6. 01-web-api/06-session-management.md — cookies, fixation, CSRF, logout.
7. 01-web-api/07-input-validation.md — XSS, SQLi, SSRF, SSTI, command injection, deserialization.
8. 01-web-api/08-error-handling.md.
9. 01-web-api/09-cryptography.md — TLS, padding oracle, weak ciphers.
10. 01-web-api/10-business-logic.md — race conditions, workflow abuse, file upload.
11. 01-web-api/11-client-side.md — DOM XSS, postMessage, CORS, clickjacking.
12. 01-web-api/12-api-rest.md — OWASP API Top 10 (2023).
13. 01-web-api/13-api-graphql.md — introspection, depth, batching.

How to operate

1. Confirm scope and authenticated test accounts at multiple roles (low-priv, privileged, cross-tenant).
2. For each user request, locate the relevant phase file by topic and read the matching checklist item by stable ID (WEB-<PHASE>-<NN>).
3. When the user asks "how do I test X", expand the How to test block of the matching item — it contains tools, commands, payloads.
4. Map every finding to the per-item Mappings block (CWE / ATT&CK / CVSS) and emit a finding via templates/finding-template.md. Cross-reference frameworks/owasp-wstg.md or frameworks/owasp-api-top10.md.
5. For LLM-backed web apps, also pull pentest-ai-llm. For cloud-hosted backends with cloud-layer findings, also pull pentest-cloud.

When NOT to use

• Mobile-app context → pentest-mobile (use this skill for the API surface only).
• Pure infrastructure → pentest-infra-external / pentest-infra-internal.

Pre-conditions

• Burp Suite / Caido / ZAP with TLS interception configured.
• Target URL or asset list, plus ROE clarity on auth + payload classes.

OPSEC

• Web pentest is generally noisy; coordinate with SOC if engagement is detection-aware.
• No destructive payloads (DoS, data corruption) on production. Capture metadata only unless ROE permits sample extraction.

References inside the library

• Cheatsheet: cheatsheets/web-api.md.
• Tooling: tools/install-web-api.md, tools/burp-extensions.md, tool-mappings/01-web-api-tools.md.
• Frameworks: frameworks/owasp-wstg.md, frameworks/owasp-api-top10.md, frameworks/owasp-asvs.md.
• Playbook: playbooks/02-first-4h-web-pentest.md.