API SecurityTesting

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read ../field-journal/precedent-pentest.md — confirm this skill's operations are authorized routine work

2. NOW: confirm the current task falls within this skill's scope

3. NEXT: read ../tool-index.md, verify tool availability and real paths

4. NEXT: if a tool is missing, call bootstrap, do not guess paths

5. ACT: enter the workflow's first step and execute, do not stop at confirmation

cover REST / GraphQL / WebSocket / SOAP allProtocol

10 PhaseMethodologydiscussion, fromDiscoveryto CI/CD integration

Scope

• REST API SecurityTesting（OpenAPI/Swagger driven or blind)

• GraphQL SecurityAudit（introspection、 batchquery、别 name过载）

• WebSocket SecurityTesting

• JWT / OAuth 2.0 AuthenticationTesting

• BOLA/IDOR/BFLA AuthorizationvulnerabilityDetection

• API Rate limitBypassand DoS Testing

10 PhaseTestingFlow

Phase 1: API Discoveryandrecon

activeDiscovery：



□ Vespasian: Headless browser crawl → auto-generate OpenAPI 3.0 / GraphQL SDL spec



□ Entropy --discover: from robots.txt + JS fileExtractendpoint



□ Kiterunner / ffuf: Brute-forcenotDocumentationize'sendpointPath



□ CheckcommonPath: /swagger.json, /openapi.json, /graphql, /api-docs







GraphQL introspection（三级尝试):



  1. standardintrospectionquery



  2. condensedquery（Bypass WAF all volumeBan）



  3. 仅查 __schema { types { name } }（最小探测）

Phase 2: AuthenticationTesting

JWT Analysis（jwt_tool / Burp):



□ alg:none Attack: modifyHeader partis "alg":"none"，清空Signature



□ Keyobfuscation: RS256 公钥 → HS256 to称Key



□ weak HMAC KeyBrute-force: jwt_tool -C -d wordlist.txt



□ 过期/声明篡改: modify exp/iat/sub/role 声明



□ kid Injection: ../../etc/passwd → HMAC SignatureBypass







OAuth 2.0：



□ redirect_uri 操控 → Authorization码leak



□ CSRF via state parametermissing



□ Token in Referer Headerleak



□ PKCE missingDetection







GraphQL Authentication：



□ mutation via GET Pull requestBypassAuthentication（CSRF）



□  batchqueryAuthenticationBypass

Phase 3: AuthorizationTesting（BOLA/IDOR/BFLA）

BOLA（to象级AuthorizationBypass):



□ enumerate数字 ID: /user/1 → /user/2 → /user/3



□ enumerate UUID



□ enumerateUser name/email



□ Burp Autorize: dualSession重放compare







BFLA（functioncan级AuthorizationBypass):



□ 普通UserExecuteManagementmember API



□ HTTP Methodologyswitch: GET → PUT → PATCH → DELETE



□ API VersionDegrade: /v2/admin → /v1/admin



□ BatchoperationInjection: {"users": [1,2,3]} → {"users": [1,2,3,admin_id]}







Tool: Burp Autorize, AuthMatrix, Entropy (malicious_insider persona)

Phase 4: GraphQL specialty

introspectionleak → 信息ExposureDetection



别 name过载 → 100+ 别 name DoS



 batchquery → 10+ 同whenquery DoS



field重复 → __typename × 500



指令过载 → recursive @skip/@include



Loopquery → Deepnestedintrospectionrecursive



fieldSuggestion → ErrorMessageinformation leak



GraphiQL/Playground Exposure → IDE 公开Risk



GET 突变 → CSRF Risk



Tracking/debug pattern → metadataleak







Tool: FireTail, Escape DAST, api.sh (Phases 1-3)

Phase 5: REST 输入Verification

□ HTTP Methodologyswitch: GET→POST→PUT→DELETE→OPTIONS→PATCH



□ Content-Type 篡改: JSON→XML→multipart



□ NoSQL Injection: {"username": {"$gt": ""}}



□ SSRF via URL parameter: webhook URL/Header像 URL/Import URL



□ XXE in XML endpoint



□ parameter污染: /api?role=user&role=admin



□ Batch赋值: toPull requestBody添加 is_admin: true

Phase 6: business logicand差分Testing

□ Entropy compare: diff v1 vs v2 API → State码变ize/fieldDelete/延迟regression



□ multi-RoleWorkflowTesting: admin/user/readonly Permission矩阵



□ 优惠券/积分/价格操控



□ 竞态条件: and发Pull requestTesting TOCTOU

Phase 7: WebSocket Testing

□ endpointDiscovery



□ MessageInjection（Injection payload、original型污染）



□ 超大Message处理



□ typeobfuscation



□ 跨sitepoint WebSocket hijacking（CSWH）

Phase 8: Rate limitand DoS

□ Rate limitBypass via Header part: X-Forwarded-For, X-Real-IP



□ Path变Body: /api/ → /api → /Api/ → /API/



□ Slowloris 低带宽耗尽



□ GraphQL  batchqueryDeepnested DoS



□ IP 轮换Testing（ProxyCat Proxy池）

Phase 9: dataExposure

□ ResponseexcessiveExposure: compare API 返回 vs UI 展示



□ 分页Enumerate: ?page=1&limit=10000



□ ErrorMessageinformation leak: 堆栈跟踪/inner partPath/SQL Error



□ GraphQL nestedenumerate访问unauthorizeddata



□ OpenAPI specificationExposuresensitiveendpoint

Phase 10: CI/CD integration

□ Entropy --ci --watch: spec 变更whenautomatic重跑



□ Escape DAST: by严重度阈值automatic阻断构建



□ DiscoveryPersistenceisregressionTesting



□ StackHawk（开发者first、ZAP inner核）

Toolchain

| Tool | Purpose | Get |

|------|------|------|

| Vespasian | Stream volume → OpenAPI/GraphQL specification | GitHub: praetorian-inc/vespasian |

| Entropy | LLM generateAttackScenario，5 personas | GitHub: arjinexe/entropy-chaos |

| Escape DAST | business logicSecurityTesting | escape.tech |

| api.sh | 8 PhaseallProtocolAttackPipeline | GitHub: Sharon-Needles/api |

| FireTail | GraphQL 12 specialtyTesting | firetail.ai |

| jwt_tool | JWT all surfaceTesting | GitHub: ticarpi/jwt_tool |

| Burp Autorize | dualSessionAuthorizationcompare | Burp BApp Store |

References

• references/rest-graphql-testing.md — REST + GraphQL DeepTesting

• references/jwt-oauth-testing.md — JWT + OAuth SecurityTesting

Task completion checklist（MUST pass before claiming completion）

• Did I execute every workflow step (not just read)?

• Did I use real tool paths based on tool-index?

• Did I produce reproducible evidence (commands/scripts/screenshots/report)?

• Did I complete and write back the RULES-required Checklist items?