Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
API Security Router — Expert Attack Playbook
AI LOAD INSTRUCTION: API security entry router. Use when you encounter REST, GraphQL, SOAP, or WebSocket APIs and need to triage: asset discovery (OpenAPI/Swagger/docs), authorization (BOLA/BFLA/IDOR), token abuse (JWT/OAuth), or hidden parameter exploitation. Routes to specialized skills for deep exploitation. Covers API recon, endpoint discovery, versioning drift, and hidden documentation exposure before handing off.
Use this skill first to determine whether the current API case is more about documentation/asset discovery, object authorization, token trust issues, or GraphQL/hidden parameters, then route to the appropriate specialized skill.
# If v2 is current, check if v1 still exists:
/api/v1/users
/api/v2/users
# v1 may have weaker auth or missing rate limits
Hidden API Documentation
# JavaScript bundle mining for API endpoints:
grep -roh '"/api/[a-zA-Z0-9/_-]*"' app.js | sort -u
grep -roh "'/api/[a-zA-Z0-9/_-]*'" app.js | sort -u
# Common hidden API patterns:
/api/admin
/api/internal
/api/debug
/api/test
/api/config
/api/health
/api/metrics
HTTP Method Enumeration
# Test all methods on each endpoint:
OPTIONS /api/users
GET /api/users
POST /api/users
PUT /api/users
PATCH /api/users
DELETE /api/users
# Some methods may be unauthenticated or have weaker authorization
COMMON API ANTI-PATTERNS
Anti-Pattern
Test
Impact
Sequential IDs (/users/1)
Change to /users/2
IDOR / BOLA
UUID in response but accepts ID
Send both
Authorization gap
Missing rate limit on login
Send 100+ requests
Brute force
Verbose error messages
Send invalid JSON
Info disclosure
CORS allows any origin
Send Origin: evil.com
Token theft
Mass assignment
Add {"role":"admin"}
Privilege escalation
No pagination limit
Request ?limit=999999
Data exposure
API key in URL
Check Referer/header logs
Key leakage
DECISION TREE
API endpoint discovered?
├── REST API (OpenAPI/Swagger docs visible)?
│ └── Route to [api-authorization-and-bola] for BOLA/BFLA testing
├── GraphQL endpoint (/graphql, introspection enabled)?
│ └── Route to [graphql] for schema abuse testing
├── SOAP/WSDL endpoint found?
│ └── Test XML parsing, SOAP injection, WSDL enumeration
├── WebSocket connection present?
│ └── Test authentication, message validation, origin enforcement
└── API type unclear?
└── Run API surface discovery, then re-triage
TESTING CHECKLIST
Discover API surface: find OpenAPI/Swagger docs, GraphQL endpoints, hidden API routes
Test authentication on every endpoint: unauthenticated access, expired tokens, missing Authorization header
Test authorization (BOLA/IDOR): replace object IDs in URLs, JSON bodies, and headers with other users' IDs
Test HTTP method abuse: try PUT/DELETE/PATCH on GET-only endpoints, and vice versa
Test hidden writable fields: send extra JSON keys in POST/PUT requests (role, isAdmin, price, etc.)
Test rate limiting: send repeated requests to login, password reset, and sensitive endpoints
