api-sec-test

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

Ir a la instalación

Repositorio: Undermybelt/hermes-skills
Última actividad en el origen: 7 de junio de 2026 a las 07:23
Idioma detectado de SKILL.md: inglés
Estrellas: 6
Forks: 1

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Undermybelt/hermes-skills --skill api-sec-test

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

4 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

Ver todos los de este repositorio

name	api-sec-test
description	Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
domain	cybersecurity
subdomain	penetration-testing
tags	["API-security","OWASP-API-Top10","REST","GraphQL","authorization-testing"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]

Conducting API Security Testing

When to Use

Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses
Assessing the security of microservices architecture where APIs are the primary communication method
Validating that API gateway protections (rate limiting, authentication, input validation) are properly enforced
Testing third-party API integrations for data exposure and insecure configurations
Evaluating GraphQL APIs for introspection disclosure, query complexity attacks, and authorization bypasses

Do not use against APIs without written authorization, for load testing or denial-of-service testing unless explicitly scoped, or for testing production APIs that process real financial transactions without safeguards.

Prerequisites

API documentation (OpenAPI/Swagger, GraphQL schema, Postman collection) or application access to reverse-engineer the API
Burp Suite Professional configured to intercept API traffic with JSON/XML content type handling
Postman or Insomnia for organizing and replaying API requests across different authentication contexts
Valid API tokens or credentials at multiple privilege levels (unauthenticated, standard user, admin)
Target API base URL and version information

Workflow

Step 1: API Discovery and Documentation

Map the complete API attack surface:

Import API documentation: Load OpenAPI/Swagger specs into Postman or Burp Suite to catalog all endpoints, methods, parameters, and authentication requirements
Reverse-engineer undocumented APIs: Proxy the mobile app or web frontend through Burp Suite and exercise all features to capture API calls. Export the Burp sitemap as the baseline endpoint inventory.
GraphQL introspection: Send an introspection query to discover the full schema:
```
{"query": "{__schema{types{name,fields{name,args{name,type{name}}}}}}"}
```
Endpoint enumeration: Fuzz for hidden API versions (/api/v1/, /api/v2/, /api/internal/), debug endpoints (/api/debug, /api/health, /api/metrics), and administrative endpoints
Document authentication mechanisms: Identify if the API uses API keys, OAuth 2.0 Bearer tokens, JWT, session cookies, or mutual TLS

Term	Definition
BOLA	Broken Object Level Authorization (OWASP API #1); failure to verify that the requesting user is authorized to access a specific object, enabling IDOR attacks
BFLA	Broken Function Level Authorization (OWASP API #5); failure to restrict administrative or privileged API functions from being accessed by lower-privilege users
Mass Assignment	A vulnerability where the API binds client-provided data to internal object properties without filtering, allowing attackers to modify fields they should not have access to
GraphQL Introspection	A built-in GraphQL feature that exposes the complete API schema including all types, fields, and relationships; should be disabled in production
JWT	JSON Web Token; a self-contained token format used for API authentication containing claims signed with a secret or key pair
Rate Limiting	Controls that restrict the number of API requests a client can make within a time window, preventing brute force, enumeration, and abuse

api-sec-test

Opciones de instalación

Revisa los archivos de origen

Conducting API Security Testing

When to Use

Prerequisites

Workflow

Step 1: API Discovery and Documentation

Conducting API Security Testing

When to Use

Prerequisites

Workflow

Step 1: API Discovery and Documentation

Step 2: Authentication and Token Testing

Step 3: Authorization Testing (BOLA/BFLA)

Step 4: Input Validation and Injection Testing

Step 5: Data Exposure and Response Analysis

Key Concepts

Tools & Systems

Common Scenarios

Scenario: API Security Assessment for a Fintech Mobile Application

Output Format

api-sec-test

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Conducting API Security Testing

When to Use

Prerequisites

Workflow

Step 1: API Discovery and Documentation

Conducting API Security Testing

When to Use

Prerequisites

Workflow

Step 1: API Discovery and Documentation

Step 2: Authentication and Token Testing

Step 3: Authorization Testing (BOLA/BFLA)

Step 4: Input Validation and Injection Testing

Step 5: Data Exposure and Response Analysis

Key Concepts

Tools & Systems

Common Scenarios

Scenario: API Security Assessment for a Fintech Mobile Application

Output Format