pentest-api

name	pentest-api
description	API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analysis, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-api","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents api-security"}

pentest-api

REST + GraphQL + WebSocket security testing methodology. Focused on OWASP API Security Top 10 (2023).

Triggers

• "API pentest"
• "OWASP API Top 10"
• "GraphQL introspection"
• "JWT swap attempt"
• "OAuth flow test"
• "BOLA / BFLA"
• "mass assignment"
• "WebSocket security"

OWASP API Top 10 (2023)

#	Category	Test Approach
API1	BOLA (Broken Object Level Auth)	/users/123 -> /users/124 enum, unauthorized data access
API2	Broken Authentication	Token replay, JWT manipulation, brute force endpoint
API3	Broken Object Property Level Auth	Mass assignment (admin: true), excessive exposure
API4	Unrestricted Resource Consumption	Missing rate limit, pagination size, file upload size
API5	BFLA (Broken Function Level Auth)	Is /admin/* reachable with a user role
API6	Unrestricted Business Flows	Bizlogic exploit (delegate to pentest-bizlogic)
API7	SSRF	URL parameter cloud metadata reach
API8	Security Misconfig	Verbose error, CORS *, default endpoint
API9	Improper Inventory	v1/v2 same endpoint, different auth, shadow API
API10	Unsafe Consumption of 3rd Party API	API key exfil, response trust

REST Test Methodology

1. Find the spec document: /swagger.json, /openapi.yaml, /api-docs
2. List endpoints + auth requirements
3. BOLA: numeric ID enum (user_id, doc_id, order_id)
4. BFLA: role change (cookie/header swap)
5. Rate limit: 100 requests/sec within 60s
6. CORS: Origin: evil.com -> reflect?
7. Verbose error: malformed body, sql-like input

GraphQL Test

# Introspection check (QUIET)
curl -X POST https://<target>/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'

# Common queries
- Field suggestion (typo) -> auto-suggest reveal
- Batching: 1000 queries in a single POST (DoS-readiness test)
- Alias overloading
- Deep nesting: { user { friend { friend { ... } } } } depth 10+

JWT Analysis

Test	Approach
alg: none	Set the header to {"alg":"none","typ":"JWT"}, remove the signature
alg confusion	RS256 -> HS256, use the public key as the secret
kid injection	kid: ../../../dev/null (SQLi if the kid is SQL-backed)
exp ignore	exp is in the past, does the server still accept it
Weak secret	Crack the JWT secret with hashcat (offline)

# QUIET — decode only (no request to any target)
echo "<token>" | python3 -c "import sys,jwt; print(jwt.decode(sys.stdin.read().strip(), options={'verify_signature': False}))"

OAuth Flow Test

• redirect_uri tampering: send the token to evil.com
• missing state parameter -> CSRF
• is response_type=token (implicit) still supported
• PKCE missing (mandatory for mobile/SPA)
• scope creep: request minimal scope, did max scope come back
• missing refresh token rotation

Mass Assignment Test

POST /api/users
Content-Type: application/json

{
  "name": "test",
  "email": "[e-mail]",
  "isAdmin": true,           # mass assignment
  "subscription": "premium"  # mass assignment
}

If the response returns isAdmin: true, the vulnerability is present.

WebSocket

• Is Origin header validation missing (CSRF-like)
• Is authentication a single handshake (mid-session re-auth?)
• Message size limit
• Binary message + WS Frame manipulation

Output Template

## API Analysis — <baseURL>

### Findings
- [HIGH] BOLA in GET /api/orders/{id} — user A can see user B's order
- [MEDIUM] GraphQL introspection is open in production
- [LOW] CORS Origin reflection (null origin only)

### Untested Areas
- BFLA admin endpoint (no admin token)
- WebSocket /ws — handshake not tested
- Rate limit threshold (outside the client's test window)

Out-of-Scope

• Live brute force (pentest-credentials)
• DDoS via rate limit absent
• Automated tool that enables a token replay attack