メニュー
Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with ZAP and custom scripts.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/PramodDutta/qaskills --skill api-security-testingコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | API Security Testing |
| description | Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with ZAP and custom scripts. |
| version | 1.0.0 |
| author | thetestingacademy |
| license | MIT |
| tags | ["api-security","owasp","authentication","authorization","injection","rate-limiting","bola","bfla","zap","security-scanning"] |
| testingTypes | ["security","api","integration","e2e"] |
| frameworks | ["playwright","vitest","jest","zap"] |
| languages | ["typescript","javascript","python"] |
| domains | ["api","backend","security"] |
| agents | ["claude-code","cursor","github-copilot","windsurf","codex","aider","continue","cline","zed","bolt","gemini-cli","amp"] |
You are an expert in API security testing. When the user asks you to test API security, implement OWASP API Top 10 checks, detect authentication and authorization vulnerabilities, or set up automated security scanning, follow these detailed instructions.
security-tests/
owasp/
bola.test.ts
broken-auth.test.ts
broken-object-property.test.ts
unrestricted-resource.test.ts
broken-function-level-auth.test.ts
mass-assignment.test.ts
ssrf.test.ts
security-misconfiguration.test.ts
improper-inventory.test.ts
unsafe-api-consumption.test.ts
auth/
token-validation.test.ts
session-management.test.ts
credential-handling.test.ts
oauth-flow.test.ts
injection/
sql-injection.test.ts
nosql-injection.test.ts
command-injection.test.ts
xss-injection.test.ts
header-injection.test.ts
rate-limiting/
rate-limit.test.ts
resource-exhaustion.test.ts
helpers/
api-client.ts
token-generator.ts
payload-generator.ts
vulnerability-reporter.ts
config/
security-config.ts
endpoints.ts
reports/
.gitkeep
// security-tests/owasp/bola.test.ts
import { describe, it, expect, beforeAll } from ;
{ } ;
(, {
: ;
: ;
: ;
: ;
( () => {
userAClient = .();
userBClient = .();
adminClient = .();
response = userAClient.(, { : });
userAResourceId = response..;
});
(, () => {
response = userBClient.();
(response.).();
});
(, () => {
response = userBClient.(, {
: ,
});
(response.).();
});
(, () => {
response = userBClient.();
(response.).();
});
(, () => {
numericId = (userAResourceId, );
(!(numericId)) {
( offset = -; offset <= ; offset++) {
(offset === ) ;
testId = numericId + offset;
response = userBClient.();
([, ]).(response.);
}
}
});
(, () => {
uuidVariations = [
userAResourceId.(, ),
userAResourceId.(),
userAResourceId.(, -) + ,
];
( variation uuidVariations) {
response = userBClient.();
(response. === ) {
expect.();
}
}
});
(, () => {
nestedEndpoints = [
,
,
,
];
( endpoint nestedEndpoints) {
response = userBClient.(endpoint);
([, ]).(response.);
}
});
});
// security-tests/auth/token-validation.test.ts
import { describe, it, expect } from 'vitest';
import { SecurityApiClient } from '../helpers/api-client';
describe('Authentication - Token Validation', () => {
it('should reject requests without tokens', async () => {
const client = new SecurityApiClient();
const response = await client.get('/api/protected-resource');
expect(response.status).toBe(401);
});
it('should reject expired tokens', async () => {
const expiredToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MDAwMDAwMDB9.expired';
const client = new SecurityApiClient(expiredToken);
const response = await client.get('/api/protected-resource');
expect(response.status).toBe(401);
});
it('should reject malformed tokens', async () => {
const malformedTokens = [
'not-a-jwt',
'Bearer invalid',
'eyJhbGciOiJub25lIn0.eyJ0ZXN0IjoiZGF0YSJ9.',
'',
'null',
'undefined',
];
for (const token of malformedTokens) {
const client = new SecurityApiClient(token);
const response = await client.get('/api/protected-resource');
expect(response.status).toBe(401);
}
});
it('should reject tokens with algorithm none attack', async () => {
// JWT with alg:none header
const noneAlgToken = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url')
+ '.' + Buffer.from(JSON.stringify({ sub: '1', role: 'admin' })).toString('base64url')
+ '.';
const client = new SecurityApiClient(noneAlgToken);
const response = await client.get('/api/admin/users');
expect(response.status).toBe(401);
});
it('should reject tokens signed with wrong key', async () => {
// This would be a JWT signed with an attacker-controlled key
const wrongKeyToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwicm9sZSI6ImFkbWluIn0.wrong_signature';
const client = new SecurityApiClient(wrongKeyToken);
const response = await client.get('/api/protected-resource');
expect(response.status).toBe(401);
});
it('should not expose token details in error responses', async () => {
const client = new SecurityApiClient('invalid-token');
const response = await client.get('/api/protected-resource');
const body = await response.text();
expect(body).not.toContain('invalid-token');
expect(body).not.toContain('secret');
expect(body).not.toContain('key');
});
});
// security-tests/injection/sql-injection.test.ts
import { describe, it, expect, beforeAll } from 'vitest';
import { SecurityApiClient } from '../helpers/api-client';
import { SQL_INJECTION_PAYLOADS } from '../helpers/payload-generator';
describe('SQL Injection Testing', () => {
let client: SecurityApiClient;
beforeAll(async () => {
client = await SecurityApiClient.authenticateAs('userA');
});
const sqlPayloads = [
"' OR '1'='1",
"'; DROP TABLE users; --",
"' UNION SELECT username, password FROM users --",
"1; SELECT * FROM information_schema.tables",
"' OR 1=1 --",
"admin'--",
"1' ORDER BY 1--",
"' AND 1=CONVERT(int, (SELECT TOP 1 table_name FROM information_schema.tables))--",
];
it('should reject SQL injection in query parameters', async () => {
for (const payload of sqlPayloads) {
const response = await client.get(`/api/users?search=${encodeURIComponent(payload)}`);
expect([400, 200]).toContain(response.status);
if (response.status === 200) {
const body = await response.json();
// Verify no data leak
expect(JSON.stringify(body)).not.toContain('information_schema');
expect(JSON.stringify(body)).not.toContain('password');
}
}
});
it('should reject SQL injection in path parameters', async () => {
for (const payload of sqlPayloads) {
const response = await client.get(`/api/users/${encodeURIComponent(payload)}`);
expect([400, 404]).toContain(response.status);
}
});
it('should reject SQL injection in request body', async () => {
for (const payload of sqlPayloads) {
const response = await client.post('/api/users/search', { query: payload });
expect(response.status).not.toBe(500);
}
});
it('should not expose SQL error details in responses', async () => {
const response = await client.get("/api/users?id=' OR 1=1");
const body = await response.text();
expect(body.toLowerCase()).not.toContain('sql');
expect(body.toLowerCase()).not.toContain('syntax error');
expect(body.toLowerCase()).not.toContain('mysql');
expect(body.toLowerCase()).not.toContain('postgresql');
expect(body.toLowerCase()).not.toContain('sqlite');
});
});
// security-tests/rate-limiting/rate-limit.test.ts
import { describe, it, expect, beforeAll } from 'vitest';
import { SecurityApiClient } from '../helpers/api-client';
describe('Rate Limiting', () => {
let client: SecurityApiClient;
beforeAll(async () => {
client = await SecurityApiClient.authenticateAs('userA');
});
it('should enforce rate limits on authentication endpoint', async () => {
const responses = [];
for (let i = 0; i < 20; i++) {
const response = await client.post('/api/auth/login', {
email: 'test@test.com',
password: 'wrong',
});
responses.push(response.status);
}
const rateLimited = responses.filter((s) => s === 429);
expect(rateLimited.length).toBeGreaterThan(0);
});
it('should include rate limit headers', async () => {
const response = await client.get('/api/users');
const headers = response.headers;
// At least one rate limiting header should be present
const hasRateHeaders =
headers.get('x-ratelimit-limit') ||
headers.get('x-ratelimit-remaining') ||
headers.get('retry-after') ||
headers.get('ratelimit-limit');
expect(hasRateHeaders).toBeTruthy();
});
it('should limit request body size', async () => {
const largePayload = { data: 'x'.repeat(10 * 1024 * 1024) }; // 10MB
const response = await client.post('/api/data', largePayload);
expect([413, 400]).toContain(response.status);
});
it('should limit pagination size', async () => {
const response = await client.get('/api/users?limit=100000');
const body = await response.json();
if (response.status === 200) {
expect(body.data?.length || body.length || 0).toBeLessThanOrEqual(100);
}
});
});
// security-tests/helpers/api-client.ts
export class SecurityApiClient {
private baseUrl: string;
private token: string;
constructor(token = '') {
this.baseUrl = process.env.API_BASE_URL || 'http://localhost:3000';
this.token = token;
}
static async authenticateAs(role: string): Promise<SecurityApiClient> {
const credentials: Record<string, { email: string; password: string }> = {
userA: { email: 'usera@test.com', password: 'TestPass123!' },
userB: { email: 'userb@test.com', password: 'TestPass456!' },
admin: { email: 'admin@test.com', password: 'AdminPass789!' },
};
const cred = credentials[role];
if (!cred) throw new Error(`Unknown role: ${role}`);
const response = await fetch(`${new SecurityApiClient().baseUrl}/api/auth/login`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(cred),
});
const data = await response.json();
return new SecurityApiClient(data.token);
}
async get(path: string): Promise<Response> {
return fetch(`${this.baseUrl}${path}`, {
headers: this.getHeaders(),
});
}
async post(path: string, body: any): Promise<Response> {
return fetch(`${this.baseUrl}${path}`, {
method: 'POST',
headers: { ...this.getHeaders(), 'Content-Type': 'application/json' },
body: JSON.stringify(body),
});
}
async put(path: string, body: any): Promise<Response> {
return fetch(`${this.baseUrl}${path}`, {
method: 'PUT',
headers: { ...this.getHeaders(), 'Content-Type': 'application/json' },
body: JSON.stringify(body),
});
}
async delete(path: string): Promise<Response> {
return fetch(`${this.baseUrl}${path}`, {
method: 'DELETE',
headers: this.getHeaders(),
});
}
private getHeaders(): Record<string, string> {
const headers: Record<string, string> = {};
if (this.token) {
headers['Authorization'] = `Bearer ${this.token}`;
}
return headers;
}
}
// security-tests/owasp/mass-assignment.test.ts
import { describe, it, expect, beforeAll } from 'vitest';
import { SecurityApiClient } from '../helpers/api-client';
describe('Mass Assignment Vulnerability', () => {
let userClient: SecurityApiClient;
beforeAll(async () => {
userClient = await SecurityApiClient.authenticateAs('userA');
});
it('should not allow setting role via user update endpoint', async () => {
const response = await userClient.put('/api/users/me', {
name: 'Updated Name',
role: 'admin',
});
// Verify the role was not changed
const profile = await userClient.get('/api/users/me');
const data = await profile.json();
expect(data.role).not.toBe('admin');
});
it('should not allow setting isVerified via registration', async () => {
const response = await userClient.post('/api/users', {
name: 'New User',
email: 'new@test.com',
password: 'Password123!',
isVerified: true,
isAdmin: true,
});
if (response.status === 201) {
const data = await response.json();
expect(data.isVerified).not.toBe(true);
expect(data.isAdmin).not.toBe(true);
}
});
it('should not allow modifying internal fields', async () => {
const internalFields = [
{ createdAt: '2020-01-01T00:00:00Z' },
{ updatedAt: '2020-01-01T00:00:00Z' },
{ deletedAt: null },
{ passwordHash: 'malicious_hash' },
{ accountBalance: 999999 },
];
for (const field of internalFields) {
const response = await userClient.put('/api/users/me', {
name: 'Test',
...field,
});
const profile = await userClient.get('/api/users/me');
const data = await profile.json();
const fieldName = Object.keys(field)[0];
expect(data[fieldName]).not.toBe(Object.values(field)[0]);
}
});
});
// security-tests/headers/security-headers.test.ts
import { describe, it, expect } from 'vitest';
describe('Security Headers', () => {
const BASE_URL = process.env.API_BASE_URL || 'http://localhost:3000';
it('should include CORS headers', async () => {
const response = await fetch(BASE_URL, {
method: 'OPTIONS',
headers: { Origin: 'https://evil-site.com' },
});
const allowOrigin = response.headers.get('access-control-allow-origin');
if (allowOrigin) {
expect(allowOrigin).not.toBe('*');
expect(allowOrigin).not.toBe('https://evil-site.com');
}
});
it('should include security headers', async () => {
const response = await fetch(BASE_URL);
// Content-Type options
const xContentType = response.headers.get('x-content-type-options');
expect(xContentType).toBe('nosniff');
// Frame options
const xFrame = response.headers.get('x-frame-options');
expect(['DENY', 'SAMEORIGIN']).toContain(xFrame);
// Strict transport security
if (BASE_URL.startsWith('https')) {
const hsts = response.headers.get('strict-transport-security');
expect(hsts).toBeTruthy();
}
});
it('should not expose server information', async () => {
const response = await fetch(BASE_URL);
const server = response.headers.get('server');
const poweredBy = response.headers.get('x-powered-by');
// Server header should not reveal specific version
if (server) {
expect(server).not.toMatch(/\d+\.\d+/);
}
// X-Powered-By should not be present
expect(poweredBy).toBeNull();
});
});