菜单
API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analysis, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-api |
| description | API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analysis, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-api","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents api-security"} |
REST + GraphQL + WebSocket security testing methodology. Focused on OWASP API Security Top 10 (2023).
| # | Category | Test Approach |
|---|---|---|
| API1 | BOLA (Broken Object Level Auth) | /users/123 -> /users/124 enum, unauthorized data access |
| API2 | Broken Authentication | Token replay, JWT manipulation, brute force endpoint |
| API3 | Broken Object Property Level Auth | Mass assignment (admin: true), excessive exposure |
| API4 | Unrestricted Resource Consumption | Missing rate limit, pagination size, file upload size |
| API5 | BFLA (Broken Function Level Auth) | Is /admin/* reachable with a user role |
| API6 | Unrestricted Business Flows | Bizlogic exploit (delegate to pentest-bizlogic) |
| API7 | SSRF | URL parameter cloud metadata reach |
| API8 | Security Misconfig | Verbose error, CORS *, default endpoint |
| API9 | Improper Inventory | v1/v2 same endpoint, different auth, shadow API |
| API10 | Unsafe Consumption of 3rd Party API | API key exfil, response trust |
1. Find the spec document: /swagger.json, /openapi.yaml, /api-docs
2. List endpoints + auth requirements
3. BOLA: numeric ID enum (user_id, doc_id, order_id)
4. BFLA: role change (cookie/header swap)
5. Rate limit: 100 requests/sec within 60s
6. CORS: Origin: evil.com -> reflect?
7. Verbose error: malformed body, sql-like input
# Introspection check (QUIET)
curl -X POST https://<target>/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'
# Common queries
- Field suggestion (typo) -> auto-suggest reveal
- Batching: 1000 queries in a single POST (DoS-readiness test)
- Alias overloading
- Deep nesting: { user { friend { friend { ... } } } } depth 10+
| Test | Approach |
|---|---|
| alg: none | Set the header to {"alg":"none","typ":"JWT"}, remove the signature |
| alg confusion | RS256 -> HS256, use the public key as the secret |
| kid injection | kid: ../../../dev/null (SQLi if the kid is SQL-backed) |
| exp ignore | exp is in the past, does the server still accept it |
| Weak secret | Crack the JWT secret with hashcat (offline) |
# QUIET — decode only (no request to any target)
echo "<token>" | python3 -c "import sys,jwt; print(jwt.decode(sys.stdin.read().strip(), options={'verify_signature': False}))"
POST /api/users
Content-Type: application/json
{
"name": "test",
"email": "test@example.com",
"isAdmin": true, # mass assignment
"subscription": "premium" # mass assignment
}
If the response returns isAdmin: true, the vulnerability is present.
## API Analysis — <baseURL>
### Findings
- [HIGH] BOLA in GET /api/orders/{id} — user A can see user B's order
- [MEDIUM] GraphQL introspection is open in production
- [LOW] CORS Origin reflection (null origin only)
### Untested Areas
- BFLA admin endpoint (no admin token)
- WebSocket /ws — handshake not tested
- Rate limit threshold (outside the client's test window)