pentest-api

name	pentest-api
description	API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analiz, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents api-security"}

pentest-api

REST + GraphQL + WebSocket guvenlik testi methodology. OWASP API Security Top 10 (2023) odakli.

Triggers

• "API pentest"
• "OWASP API Top 10"
• "GraphQL introspection"
• "JWT swap denemesi"
• "OAuth flow test"
• "BOLA / BFLA"
• "mass assignment"
• "WebSocket guvenlik"

OWASP API Top 10 (2023)

#	Kategori	Test Yaklasimi
API1	BOLA (Broken Object Level Auth)	/users/123 -> /users/124 enum, yetkisiz veri erisimi
API2	Broken Authentication	Token replay, JWT manipulation, brute force endpoint
API3	Broken Object Property Level Auth	Mass assignment (admin: true), excessive exposure
API4	Unrestricted Resource Consumption	Rate limit eksik, pagination size, file upload size
API5	BFLA (Broken Function Level Auth)	/admin/* user role ile erisilir mi
API6	Unrestricted Business Flows	Bizlogic exploit (pentest-bizlogic'e devret)
API7	SSRF	URL parametre cloud metadata reach
API8	Security Misconfig	Verbose error, CORS *, default endpoint
API9	Improper Inventory	v1/v2 ayni endpoint farkli auth, shadow API
API10	Unsafe Consumption of 3rd Party API	API anahtari exfil, response trust

REST Test Methodology

1. Spec dokuman bul: /swagger.json, /openapi.yaml, /api-docs
2. Endpoint listele + auth gereksinimleri
3. BOLA: numeric ID enum (user_id, doc_id, order_id)
4. BFLA: rol degisikligi (cookie/header swap)
5. Rate limit: 100 istek/sn 60sn icinde
6. CORS: Origin: evil.com -> reflect?
7. Verbose error: malformed body, sql-like input

GraphQL Test

# Introspection check (QUIET)
curl -X POST https://<hedef>/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'

# Common queries
- Field suggestion (typo) -> auto-suggest reveal
- Batching: tek POST'ta 1000 query (DoS hazirlik testi)
- Alias overloading
- Deep nesting: { user { friend { friend { ... } } } } depth 10+

JWT Analiz

Test	Yaklasim
alg: none	Header'i {"alg":"none","typ":"JWT"} yap, imzayi sil
alg confusion	RS256 -> HS256, public key'i secret olarak kullan
kid injection	kid: ../../../dev/null (SQL kid varsa SQLi)
exp ignore	exp gecmis, server yine de kabul ediyor mu
Weak secret	hashcat ile JWT secret crack (offline)

# QUIET — decode only (hicbir hedefe istek yok)
echo "<token>" | python3 -c "import sys,jwt; print(jwt.decode(sys.stdin.read().strip(), options={'verify_signature': False}))"

OAuth Flow Test

• redirect_uri tampering: evil.com'a token gonderme
• state parameter eksik -> CSRF
• response_type=token (implicit) hala destekleniyor mu
• PKCE eksik (mobile/SPA icin zorunlu)
• scope creep: minimal scope iste, max scope geldi mi
• Refresh token rotation eksik

Mass Assignment Test

POST /api/users
Content-Type: application/json

{
  "name": "test",
  "email": "[e-mail]",
  "isAdmin": true,           # mass assignment
  "subscription": "premium"  # mass assignment
}

Response'da isAdmin: true donerse zafiyet var.

WebSocket

• Origin header validation eksik mi (CSRF-like)
• Authentication tek handshake'te mi (mid-session re-auth?)
• Message size limit
• Binary message + WS Frame manipulation

Output Sablonu

## API Analiz — <baseURL>

### Bulgu
- [HIGH] BOLA in GET /api/orders/{id} — user A, user B siparisini gorebiliyor
- [MEDIUM] GraphQL introspection production'da acik
- [LOW] CORS Origin reflection (sadece null origin)

### Test Edilmemis Alanlar
- BFLA admin endpoint (admin token yok)
- WebSocket /ws — handshake test edilmedi
- Rate limit thresholdu (musteri test penceresi disinda)

Out-of-Scope

• Live brute force (pentest-credentials)
• DDoS via rate limit absent
• Token replay attack saglayan automated tool