api-security

Files (40)

• SKILL.md
• INDEX.md · reference/
• api-security-principles.md · reference/
• graphql-resources.md · reference/
• owasp-api-top10-coverage.md · reference/
• auth-bypass-and-injection.md · reference/scenarios/graphql/
• csrf-and-content-type.md · reference/scenarios/graphql/
• dos-and-batching.md · reference/scenarios/graphql/
• endpoint-discovery.md · reference/scenarios/graphql/
• idor-and-mass-enumeration.md · reference/scenarios/graphql/
• introspection-and-bypass.md · reference/scenarios/graphql/
• rate-limit-bypass.md · reference/scenarios/graphql/
• schema-reconstruction.md · reference/scenarios/graphql/
• inspector-stdio-rce.md · reference/scenarios/mcp/
• api-recon-and-discovery.md · reference/scenarios/rest/
• content-type-confusion-xxe.md · reference/scenarios/rest/
• cors-misconfiguration.md · reference/scenarios/rest/
• exposed-documentation.md · reference/scenarios/rest/
• https-downgrade-redirect-hsts.md · reference/scenarios/rest/
• mass-assignment.md · reference/scenarios/rest/
• mattermost-slash-command-dialog-hijack.md · reference/scenarios/rest/
• options-method-enumeration.md · reference/scenarios/rest/
• owasp-bola-bopla.md · reference/scenarios/rest/
• sspp-query-string.md · reference/scenarios/rest/
• sspp-rest-path.md · reference/scenarios/rest/
• unauth-existence-oracle.md · reference/scenarios/rest/
• unauthenticated-webhook-oracle.md · reference/scenarios/rest/
• verbose-error-schema-disclosure.md · reference/scenarios/rest/
• waf-bypass-techniques.md · reference/scenarios/rest/
• insecure-output-xss.md · reference/scenarios/web-llm/
• os-command-injection-via-llm.md · reference/scenarios/web-llm/
• prompt-injection-direct.md · reference/scenarios/web-llm/
• prompt-injection-indirect.md · reference/scenarios/web-llm/
• sqli-via-llm.md · reference/scenarios/web-llm/
• auth-bypass-and-handshake-tricks.md · reference/scenarios/websocket/
• cswsh.md · reference/scenarios/websocket/
• discovery-and-handshake.md · reference/scenarios/websocket/
• message-injection.md · reference/scenarios/websocket/
• web-llm-attacks-resources.md · reference/
• websockets-resources.md · reference/

SKILL.md (first lines)

# API Security

Test API endpoints for security vulnerabilities across REST, GraphQL, WebSocket, and LLM-integrated APIs.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **GraphQL** | Introspection, batching attacks, nested query DoS, field suggestion |
| **REST API** | BOLA/IDOR, mass assignment, rate limiting, auth bypass, versioning |
| **WebSocket** | Cross-site hijacking, message manipulation, auth flaws |
| **Web-LLM** | Prompt injection via API, excessive agency, data exfiltration |

## Workflow

1. Discover API endpoints and documentation (Swagger, GraphQL schema)
2. Map authentication and authorization mechanisms
3. Test per API type using appropriate techniques
4. Validate data exposure and access control flaws
5. Capture evidence with HTTP request/response logs

## Reference

- `reference/graphql*.md` - GraphQL attack techniques and labs
- `reference/scenarios/rest/*.md` - REST API security testing (BOLA/BOPLA, mass assignment, SSPP, content-type confusion)
- `reference/websockets*.md` - WebSocket vulnerability testing
- `reference/web-llm*.md` - Web-LLM attack techniques and labs

From gohilrajbha0312/Pentest-tool, MIT.