API Security Testing Skill

API 安全测试 Skill

You are an API security expert specializing in REST, GraphQL, and API pentesting. Use this skill when the user requests help with:

REST API security testing
GraphQL API exploitation
API authentication bypass
API authorization flaws
Rate limiting bypass
API fuzzing
Mass assignment vulnerabilities
API documentation discovery

你是一名 API 安全专家，专门从事 REST、GraphQL 和 API 渗透测试。当用户请求以下方面的帮助时，请使用此 skill：

REST API 安全测试
GraphQL API 漏洞利用
API 身份验证绕过
API 授权缺陷
速率限制绕过
API 模糊测试
Mass Assignment（批量赋值）漏洞
API 文档发现

When to Use

使用时机

Activate this skill when the user asks to:

Test REST or GraphQL APIs
Find API vulnerabilities
Bypass API authentication/authorization
Discover API endpoints
Test API business logic
Perform API fuzzing
Analyze API documentation
Help with API penetration testing

当用户提出以下要求时，启用此 skill：

测试 REST 或 GraphQL API
查找 API 漏洞
绕过 API 身份验证/授权
发现 API 端点
测试 API 业务逻辑
执行 API 模糊测试
分析 API 文档
协助进行 API 渗透测试

When NOT to Use

不应使用此 skill 的情况

Source code is available — use
```
auditing-code-for-vulnerabilities
```
Browser-rendered application surface — use
```
testing-web-applications
```
Token and signature construction review — use
```
reviewing-cryptography
```
LLM/agent tool APIs — use
```
securing-ai-systems
```
GraphQL specifically — use
```
attacking-graphql
```
; authorization moves to resolvers and per-request rate limits break on batching
gRPC / protobuf — use
```
attacking-grpc-protobuf
```
; the schema must be recovered before anything else works
A parameter that makes the server fetch a URL — use
```
exploiting-ssrf
```
A body or cookie holding a serialized object — use
```
exploiting-deserialization
```
A JWT bearer token to forge, crack, or confuse — use
```
attacking-jwt
```
The OAuth/OIDC flow that issues the token — use
```
attacking-oauth-oidc
```
An XML or SOAP body that may resolve external entities — use
```
exploiting-xxe
```

源代码可用 — 使用
```
auditing-code-for-vulnerabilities
```
浏览器渲染的应用界面 — 使用
```
testing-web-applications
```
令牌和签名构造审查 — 使用
```
reviewing-cryptography
```
LLM/agent 工具 API — 使用
```
securing-ai-systems
```
专门针对 GraphQL — 使用
```
attacking-graphql
```
；授权问题转移到 resolver，且逐请求速率限制会因批处理而失效
gRPC / protobuf — 使用
```
attacking-grpc-protobuf
```
；必须先恢复 schema，之后其他操作才能生效
参数会使服务器获取 URL — 使用
```
exploiting-ssrf
```
请求正文或 cookie 包含序列化对象 — 使用
```
exploiting-deserialization
```
需要伪造、破解或混淆 JWT bearer token — 使用
```
attacking-jwt
```
颁发 token 的 OAuth/OIDC 流程 — 使用
```
attacking-oauth-oidc
```
可能解析外部实体的 XML 或 SOAP 正文 — 使用
```
exploiting-xxe
```

Core Methodologies

核心方法

1. API Discovery and Reconnaissance

1. API 发现与侦察

Find API Endpoints:

bash

undefined

查找 API 端点：

bash

undefined

Common API paths

/api/ /api/v1/ /api/v2/ /rest/ /graphql /swagger /api-docs /swagger.json /swagger.yaml /openapi.json /api/swagger-ui/ /api/docs

Directory fuzzing for APIs

ffuf -u https://target.com/FUZZ -w api-wordlist.txt -mc 200,301,302,403 gobuster dir -u https://target.com -w api-paths.txt

JavaScript analysis

Extract API endpoints from JS files


**API Documentation:**
```bash


**API 文档：**
```bash

Swagger/OpenAPI

curl https://target.com/swagger.json curl https://target.com/v2/swagger.json curl https://target.com/api-docs

Check for exposed docs

https://target.com/docs https://target.com/api/docs https://target.com/swagger-ui/ https://target.com/redoc


**Subdomain Enumeration for APIs:**
```bash

https://target.com/docs https://target.com/api/docs https://target.com/swagger-ui/ https://target.com/redoc


**API 子域名枚举：**
```bash

Common API subdomains

api.target.com api-dev.target.com api-staging.target.com api-prod.target.com rest.target.com graphql.target.com

Subdomain fuzzing

ffuf -u https://FUZZ.target.com -w subdomains.txt

undefined

ffuf -u https://FUZZ.target.com -w subdomains.txt

undefined

2. REST API Testing

2. REST API 测试

HTTP Methods Testing:

bash

undefined

HTTP 方法测试：

bash

undefined

Check all HTTP methods

curl -X GET https://api.target.com/users/1 curl -X POST https://api.target.com/users curl -X PUT https://api.target.com/users/1 curl -X DELETE https://api.target.com/users/1 curl -X PATCH https://api.target.com/users/1 curl -X HEAD https://api.target.com/users/1 curl -X OPTIONS https://api.target.com/users/1

Check for method override

curl -X POST https://api.target.com/users/1 -H "X-HTTP-Method-Override: DELETE" curl -X POST https://api.target.com/users/1 -H "X-Method-Override: PUT"


**Authentication Testing:**
```bash

curl -X POST https://api.target.com/users/1 -H "X-HTTP-Method-Override: DELETE" curl -X POST https://api.target.com/users/1 -H "X-Method-Override: PUT"


**身份验证测试：**
```bash

No authentication

curl https://api.target.com/users

Bearer token

curl https://api.target.com/users -H "Authorization: Bearer TOKEN"

Basic auth

curl -u username:password https://api.target.com/users

API key

curl https://api.target.com/users?api_key=KEY curl https://api.target.com/users -H "X-API-Key: KEY"

JWT token

curl https://api.target.com/users -H "Authorization: Bearer eyJhbGc..."


**IDOR (Insecure Direct Object Reference):**
```bash

curl https://api.target.com/users -H "Authorization: Bearer eyJhbGc..."


**IDOR（不安全的直接对象引用）：**
```bash

Test sequential IDs

curl https://api.target.com/users/1 curl https://api.target.com/users/2 curl https://api.target.com/users/100

Test UUIDs

curl https://api.target.com/users/550e8400-e29b-41d4-a716-446655440000

Test with different users

User A's token accessing User B's data

curl https://api.target.com/users/2 -H "Authorization: Bearer USER_A_TOKEN"


**Mass Assignment:**
```bash

curl https://api.target.com/users/2 -H "Authorization: Bearer USER_A_TOKEN"


**Mass Assignment（批量赋值）：**
```bash

Modify request to include unexpected fields

Original: {"username":"test","email":"test@test.com"}

Modified: {"username":"test","email":"test@test.com","role":"admin","is_admin":true}

curl -X POST https://api.target.com/users
-H "Content-Type: application/json"
-d '{"username":"hacker","email":"hack@test.com","role":"admin","is_admin":true}'

Common fields to try

role, is_admin, admin, user_level, permissions, credits, balance


**Excessive Data Exposure:**
```bash


**过度数据暴露：**
```bash

Check response for sensitive data

curl https://api.target.com/users | jq

Look for:

- Password hashes

- Internal IDs

- Email addresses

- API keys

- Tokens

- PII

undefined

undefined

3. GraphQL API Testing

3. GraphQL API 测试

See references/graphql-and-injection-attacks.md for GraphQL discovery endpoints, introspection queries, query/mutation examples, and GraphQL-specific attack payloads (IDOR, mass assignment, batching/nesting DoS, alias abuse). For a full engagement, use the dedicated

attacking-graphql

skill.

有关 GraphQL 发现端点、introspection 查询、query/mutation 示例，以及 GraphQL 专用攻击 payload（IDOR、Mass Assignment、批处理/嵌套 DoS、alias 滥用），请参阅 references/graphql-and-injection-attacks.md。对于完整测试，请使用专用的

attacking-graphql

skill。

4. Authorization Testing

4. 授权测试

Horizontal Privilege Escalation:

bash

undefined

水平权限提升：

bash

undefined

User A trying to access User B's resources

Get User A's token

TOKEN_A=$(curl -X POST https://api.target.com/login -d '{"username":"userA","password":"passA"}' | jq -r .token)

Try to access User B's data with User A's token

curl https://api.target.com/users/2 -H "Authorization: Bearer $TOKEN_A" curl https://api.target.com/users/2/orders -H "Authorization: Bearer $TOKEN_A"


**Vertical Privilege Escalation:**
```bash

curl https://api.target.com/users/2 -H "Authorization: Bearer $TOKEN_A" curl https://api.target.com/users/2/orders -H "Authorization: Bearer $TOKEN_A"


**垂直权限提升：**
```bash

Regular user trying to access admin functions

Get regular user token

TOKEN_USER=$(curl -X POST https://api.target.com/login -d '{"username":"user","password":"pass"}' | jq -r .token)

Try admin endpoints

curl https://api.target.com/admin/users -H "Authorization: Bearer $TOKEN_USER" curl -X DELETE https://api.target.com/admin/users/1 -H "Authorization: Bearer $TOKEN_USER"


**Function Level Authorization:**
```bash

curl https://api.target.com/admin/users -H "Authorization: Bearer $TOKEN_USER" curl -X DELETE https://api.target.com/admin/users/1 -H "Authorization: Bearer $TOKEN_USER"


**函数级授权：**
```bash

Test all endpoints with different user roles

- Unauthenticated

- Low-privilege user

- Medium-privilege user

- Admin user

Endpoints to test

GET /api/admin/* POST /api/admin/* DELETE /api/admin/* PUT /api/admin/*

undefined

GET /api/admin/* POST /api/admin/* DELETE /api/admin/* PUT /api/admin/*

undefined

5. Rate Limiting and DoS

5. 速率限制与 DoS

Test Rate Limits:

bash

undefined

测试速率限制：

bash

undefined

Rapid requests

for i in {1..1000}; do curl https://api.target.com/expensive-endpoint & done

Check response headers

curl -I https://api.target.com/endpoint

Look for:

X-RateLimit-Limit

X-RateLimit-Remaining

X-RateLimit-Reset

Retry-After


**Rate Limit Bypass:**
```bash


**速率限制绕过：**
```bash

Change IP (X-Forwarded-For, X-Real-IP)

curl https://api.target.com/endpoint -H "X-Forwarded-For: 1.2.3.4" curl https://api.target.com/endpoint -H "X-Real-IP: 1.2.3.4" curl https://api.target.com/endpoint -H "X-Originating-IP: 1.2.3.4"

Change User-Agent

curl https://api.target.com/endpoint -H "User-Agent: Different-Agent"

Add junk parameters

curl https://api.target.com/endpoint?random=123 curl https://api.target.com/endpoint?random=456

Case manipulation

curl https://api.target.com/Endpoint curl https://api.target.com/ENDPOINT

undefined

curl https://api.target.com/Endpoint curl https://api.target.com/ENDPOINT

undefined

6. API Fuzzing

6. API 模糊测试

Parameter Fuzzing:

bash

undefined

参数模糊测试：

bash

undefined

ffuf for parameter discovery

ffuf -u https://api.target.com/endpoint?FUZZ=test -w parameters.txt

Arjun

arjun -u https://api.target.com/endpoint

Test various inputs

curl https://api.target.com/users?id=1 curl https://api.target.com/users?id=../../etc/passwd curl https://api.target.com/users?id=<script>alert(1)</script> curl https://api.target.com/users?id=' OR '1'='1


**Fuzzing with wfuzz:**
```bash

curl https://api.target.com/users?id=1 curl https://api.target.com/users?id=../../etc/passwd curl https://api.target.com/users?id=<script>alert(1)</script> curl https://api.target.com/users?id=' OR '1'='1


**使用 wfuzz 进行模糊测试：**
```bash

POST data fuzzing

wfuzz -z file,wordlist.txt -d "username=FUZZ&password=test" https://api.target.com/login

Header fuzzing

wfuzz -z file,wordlist.txt -H "X-Custom-Header: FUZZ" https://api.target.com/endpoint


**Content-Type Confusion:**
```bash

wfuzz -z file,wordlist.txt -H "X-Custom-Header: FUZZ" https://api.target.com/endpoint


**Content-Type 混淆：**
```bash

Try different content types

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/json"
-d '{"user":"admin"}'

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/xml"
-d '<user>admin</user>'

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/x-www-form-urlencoded"
-d 'user=admin'

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/json"
-d '{"user":"admin"}'

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/xml"
-d '<user>admin</user>'

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/x-www-form-urlencoded"
-d 'user=admin'

Send JSON to XML endpoint and vice versa

undefined

undefined

7. API Security Tools

7. API 安全工具

Burp Suite:

bash

undefined

Burp Suite：

bash

undefined

Send requests to Repeater for manual testing

Use Intruder for fuzzing

Scan with active/passive scanner

Use extensions: Autorize, AuthMatrix, JWT4B


**Postman:**
```bash


**Postman：**
```bash

Import API collection

Test all endpoints

Use environment variables for tokens

Create test scripts

Export collection for collaboration


**OWASP ZAP:**
```bash


**OWASP ZAP：**
```bash

Automated API scan

zap-cli quick-scan https://api.target.com

Spider API

zap-cli spider https://api.target.com

Active scan

zap-cli active-scan https://api.target.com


**API-specific Tools:**
```bash

zap-cli active-scan https://api.target.com


**API 专用工具：**
```bash

RESTler (Microsoft) - REST API fuzzer

git clone https://github.com/microsoft/restler-fuzzer python3 restler.py --api_spec swagger.json

Kiterunner - API endpoint discovery

kr scan https://target.com -w routes.txt

Nuclei with API templates

nuclei -u https://api.target.com -t ~/nuclei-templates/api/

undefined

nuclei -u https://api.target.com -t ~/nuclei-templates/api/

undefined

8. API Injection Attacks

8. API 注入攻击

See references/graphql-and-injection-attacks.md for the full API injection payload catalog: SQL, command, NoSQL, and XXE payloads for both query parameters and JSON/XML request bodies.

有关完整的 API 注入 payload 目录，包括用于查询参数和 JSON/XML 请求正文的 SQL、命令、NoSQL 和 XXE payload，请参阅 references/graphql-and-injection-attacks.md。

9. API Documentation Analysis

9. API 文档分析

Swagger/OpenAPI Analysis:

bash

undefined

Swagger/OpenAPI 分析：

bash

undefined

Download spec

curl https://api.target.com/swagger.json > swagger.json

Analyze with jq

cat swagger.json | jq '.paths' cat swagger.json | jq '.definitions'

Extract all endpoints

cat swagger.json | jq -r '.paths | keys[]'

Find parameters

cat swagger.json | jq '.paths[].get.parameters'

undefined

cat swagger.json | jq '.paths[].get.parameters'

undefined

10. API Security Checklist

10. API 安全检查清单

Quick Testing Commands

快速测试命令

Test Endpoint:

bash

undefined

测试端点：

bash

undefined

GET request

curl -v https://api.target.com/endpoint

POST with JSON

curl -X POST https://api.target.com/endpoint
-H "Content-Type: application/json"
-d '{"key":"value"}'

With authentication

curl https://api.target.com/endpoint
-H "Authorization: Bearer TOKEN"

See full response

curl -i https://api.target.com/endpoint

undefined

curl -i https://api.target.com/endpoint

undefined

Troubleshooting

故障排除

CORS Issues:

bash

undefined

CORS 问题：

bash

undefined

Check CORS headers

curl -H "Origin: https://evil.com" https://api.target.com/endpoint

Look for:

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true


**Rate Limited:**
```bash


**触发速率限制：**
```bash

Add delays between requests

for i in {1..100}; do curl https://api.target.com/endpoint; sleep 1; done

Try bypass techniques (X-Forwarded-For, etc.)

undefined

undefined

Reference Links

参考链接

OWASP API Security Top 10: https://owasp.org/www-project-api-security/
HackTricks API Testing: https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/graphql
API Security Best Practices: https://github.com/OWASP/API-Security
PayloadsAllTheThings API: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/API%20Key%20Leaks
GraphQL and injection payload catalogs: references/graphql-and-injection-attacks.md

OWASP API Security Top 10: https://owasp.org/www-project-api-security/
HackTricks API Testing: https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/graphql
API Security Best Practices: https://github.com/OWASP/API-Security
PayloadsAllTheThings API: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/API%20Key%20Leaks
GraphQL 和注入 payload 目录: references/graphql-and-injection-attacks.md

ATT&CK Coverage

ATT&CK 覆盖范围

Generated from
secskills-core/ttp-index.json
— edit that file, then run
python3 scripts/sync_attack.py --write
. Re-verify IDs against the current ATT&CK release before citing them in a report.

Initial Access (TA0001)

T1190 Exploit Public-Facing Application — see also

testing-web-applications

,

enumerating-network-services

,

attacking-graphql

,

attacking-grpc-protobuf

,

exploiting-deserialization

,

exploiting-ssrf

,

exploiting-xxe

Credential Access (TA0006)

T1528 Steal Application Access Token — see also

exploiting-cloud-platforms

,

attacking-entra-id

,

attacking-oauth-oidc

Detection content for any of these:

engineering-detections

. Proactive search:

hunting-threats

. Post-compromise:

responding-to-incidents

.

由
secskills-core/ttp-index.json
生成——编辑该文件，然后运行
python3 scripts/sync_attack.py --write
。在报告中引用之前，请对照当前 ATT&CK 版本重新核验 ID。

初始访问（Initial Access） (TA0001)

T1190 Exploit Public-Facing Application — 另见

testing-web-applications

、

enumerating-network-services

、

attacking-graphql

、

attacking-grpc-protobuf

、

exploiting-deserialization

、

exploiting-ssrf

、

exploiting-xxe

凭据访问（Credential Access） (TA0006)

T1528 Steal Application Access Token — 另见

exploiting-cloud-platforms

、

attacking-entra-id

、

attacking-oauth-oidc

上述任何技术的检测内容：

engineering-detections

。主动搜索：

hunting-threats

。失陷后响应：

responding-to-incidents

。

testing-apis

Original

Translation

API Security Testing Skill

API 安全测试 Skill

When to Use

使用时机

When NOT to Use

不应使用此 skill 的情况

Core Methodologies

核心方法

1. API Discovery and Reconnaissance

1. API 发现与侦察

Common API paths

Common API paths

Directory fuzzing for APIs

Directory fuzzing for APIs

JavaScript analysis

JavaScript analysis

Extract API endpoints from JS files

Extract API endpoints from JS files

Swagger/OpenAPI

Swagger/OpenAPI

Check for exposed docs

Check for exposed docs

Common API subdomains

Common API subdomains

Subdomain fuzzing

Subdomain fuzzing

2. REST API Testing

2. REST API 测试

Check all HTTP methods

Check all HTTP methods

Check for method override

Check for method override

No authentication

No authentication

Bearer token

Bearer token

Basic auth

Basic auth

API key

API key

JWT token

JWT token

Test sequential IDs

Test sequential IDs

Test UUIDs

Test UUIDs

Test with different users

Test with different users

User A's token accessing User B's data

User A's token accessing User B's data

Modify request to include unexpected fields

Modify request to include unexpected fields

Original: {"username":"test","email":"test@test.com"}

Original: {"username":"test","email":"test@test.com"}

Modified: {"username":"test","email":"test@test.com","role":"admin","is_admin":true}

Modified: {"username":"test","email":"test@test.com","role":"admin","is_admin":true}

Common fields to try

Common fields to try

role, is_admin, admin, user_level, permissions, credits, balance

role, is_admin, admin, user_level, permissions, credits, balance

Check response for sensitive data

Check response for sensitive data

Look for:

Look for:

- Password hashes

- Password hashes

- Internal IDs

- Internal IDs

- Email addresses

- Email addresses

- API keys

- API keys

- Tokens

- Tokens

- PII

- PII

3. GraphQL API Testing