api-security-top10

OWASP API Security Top 10 as a dedicated API-only checklist -- BOLA, BFLA, broken object-property-level authz/mass assignment, unrestricted resource consumption, unsafe business-flow access, security misconfiguration, improper inventory management (shadow/zombie APIs), unsafe third-party API consumption, plus GraphQL/gRPC/SOAP/WebSocket coverage. Converted from master-pentest-prompt.md Phase 33. Use on API-only targets (no traditional web UI) as the dedicated checklist -- for mixed web+API targets the vuln-class skills already cover most of this ground per-endpoint.

インストールへ移動

リポジトリ: ankitsingh015/HuntMCP
ソースの最終更新活動: 2026年8月24日 12:56
検出された SKILL.md の言語: 英語
スター: 4
フォーク: 0

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/ankitsingh015/HuntMCP --skill api-security-top10

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

このリポジトリのすべてを見る

OWASP API Security Top 10 (dedicated -- API yes, plain web no)

When to use

API-only targets, run per endpoint and per HTTP method, both authenticated and unauthenticated. On a mixed web+API target, the individual vuln-class skills (access-control-and-idor, ssrf, etc.) already cover most of this per-endpoint -- this skill is for treating the API surface as its own dedicated pass, and for the API-specific items (schema extraction, inventory management) those skills don't otherwise name.

The ten items

BOLA (Broken Object Level Authorization): object IDs accessible across users via UUID, sequential ID, or enum -- check nested objects and deep-linked resources too, not just the top-level ID.

BFLA (Broken Function Level Authorization): a lower-privilege role successfully calling an admin-only function.

Broken Object Property Level Authorization: mass assignment or read-only field tampering (role: admin, balance: 0, verified: true) sent in a request body the client shouldn't be able to set.

Unrestricted Resource Consumption: no rate limit, no size limit, no query-depth limit, no pagination cap, multi-query DoS via a single expensive request.

Broken Function Level Auth: missing authentication entirely on endpoints that should require it.

Unrestricted access to sensitive business flows: change, transfer, or refund operations executable without proper step-up verification.

SSRF (see the ssrf skill for the general technique) and server-side XSS via API responses that get rendered into HTML somewhere downstream.

Security misconfiguration: default or overly permissive CORS, verbose error bodies, unnecessary HTTP methods left enabled, missing TLS on an API subdomain specifically.

Improper Inventory Management: old/unversioned endpoints still live, shadow APIs shipped from stale code paths, non-production endpoints reachable publicly.

Unsafe consumption of APIs: the target calling third-party APIs without validating their responses, letting an upstream compromise become the target's own vulnerability.

Protocol-specific coverage

GraphQL (introspection left enabled, batching abuse -- see deep-cut-surfaces for the fuller GraphQL list), gRPC (see microservices-and-internal-api for reflection/proto-leak detail), SOAP/XML (XXE -- see the xxe skill), WebSocket subscriptions with no auth check, and importer/webhook features that follow an attacker-supplied URL.

Schema-driven fuzzing

Pull the OpenAPI/Swagger schema (see misc-deep-cuts for exposure paths like /swagger-ui, /redoc) and fuzz every defined operation from it. Test both idempotent and non-idempotent verbs, and check any endpoint touching PII specifically for its inter-consumer-security (ICS) logic.