[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GQS07TAZK26ECC8STPSA5":3,"skill-same:01M71GQS07TAZK26ECC8STPSA5":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":14,"repositoryHtmlUrl":77,"repositoryHomepageUrl":6,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M71GQS07TAZK26ECC8STPSA5","api-owasp-analyze",null,"Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fowasp\u002Fanalyze\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"api","analyze","owasp","api owasp analyze","pr","web-application-security","penetration","sonnet","security","read","de","top","Bash","cybersecurity","api-security","postman","testing","cm","manual testing","rest-api","2026-11-10 10:12:30",false,"---\nname: api-owasp-analyze\ndescription: Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- api-security\n- owasp\n- rest-api\n- graphql\n- burpsuite\n- postman\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncwe:\n- CWE-200\ncapec: []\n---\n\n# Testing API Security with OWASP Top 10\n\n## When to Use\n\n- During authorized API penetration testing engagements\n- When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities\n- Before deploying new API endpoints to production environments\n- When reviewing API security posture against the OWASP API Security Top 10 (2023)\n- For validating API gateway security controls and rate limiting effectiveness\n\n## Prerequisites\n\n- **Authorization**: Written scope document covering all API endpoints to be tested\n- **Burp Suite Professional**: For intercepting and modifying API requests\n- **Postman**: For organizing and executing API test collections\n- **ffuf**: For API endpoint and parameter fuzzing\n- **curl\u002Fhttpie**: Command-line HTTP clients for manual testing\n- **API documentation**: Swagger\u002FOpenAPI spec, GraphQL schema, or API docs\n- **jq**: JSON processor for parsing API responses (`apt install jq`)\n\n## Workflow\n\n### Step 1: Discover and Map API Endpoints\n\nEnumerate all available API endpoints and understand the API surface.\n\n```bash\n# If OpenAPI\u002FSwagger spec is available, download it\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fswagger.json\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fv2\u002Fapi-docs\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fopenapi.yaml\"\n\n# Fuzz for API endpoints\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,401,403,405 \\\n  -fc 404 \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -o api-enum.json -of json\n\n# Fuzz for API versions\nfor v in v1 v2 v3 v4 beta internal admin; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\")\n  echo \"$v: $status\"\ndone\n\n# Check for GraphQL endpoint\nfor path in graphql graphiql playground query gql; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n```\n\n### Step 2: Test API1 - Broken Object Level Authorization (BOLA)\n\nTest whether users can access objects belonging to other users by manipulating IDs.\n\n```bash\n# Authenticate as User A and get their resources\nTOKEN_A=\"Bearer eyJhbGciOiJIUzI1NiIs...\"\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\u002Forders\" | jq .\n\n# Try accessing User B's resources with User A's token\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F102\u002Forders\" | jq .\n\n# Fuzz object IDs with Burp Intruder or ffuf\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Forders\u002FFUZZ\" \\\n  -w \u003C(seq 1 1000) \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -mc 200 -t 10 -rate 50\n\n# Test IDOR with different ID formats\n# Numeric: \u002Fusers\u002F102\n# UUID: \u002Fusers\u002F550e8400-e29b-41d4-a716-446655440000\n# Encoded: \u002Fusers\u002FMTAy (base64)\n```\n\n### Step 3: Test API2 - Broken Authentication\n\nAssess authentication mechanisms for weaknesses.\n\n```bash\n# Test for missing authentication\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | jq .\n\n# Test JWT token vulnerabilities\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull | jq .\n\n# Test \"alg: none\" attack\n# Header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Create unsigned token with modified claims\n\n# Test brute-force protection on login\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\" \\\n  -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"admin@target.com\",\"password\":\"FUZZ\"}' \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-1000.txt \\\n  -mc 200 -t 5 -rate 10\n\n# Test password reset flow\ncurl -s -X POST \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Freset\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"victim@target.com\"}'\n\n# Check if token is in response body instead of email only\n```\n\n### Step 4: Test API3 - Broken Object Property Level Authorization\n\nTest for excessive data exposure and mass assignment vulnerabilities.\n\n```bash\n# Check for excessive data in responses\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n# Look for: password hashes, SSNs, internal IDs, admin flags, PII\n\n# Test mass assignment - try adding admin properties\ncurl -s -X PUT \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Test User\",\"role\":\"admin\",\"is_admin\":true}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Test with PATCH method\ncurl -s -X PATCH \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"balance\":999999}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Check if filtering parameters expose more data\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?fields=all\" | jq .\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?include=password,ssn\" | jq .\n```\n\n### Step 5: Test API4\u002FAPI6 - Rate Limiting and Unrestricted Access to Sensitive Flows\n\nVerify rate limiting and resource consumption controls.\n\n```bash\n# Test rate limiting on authentication endpoint\nfor i in $(seq 1 100); do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"email\":\"test@test.com\",\"password\":\"wrong\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\")\n  echo \"Attempt $i: $status\"\n  if [ \"$status\" == \"429\" ]; then\n    echo \"Rate limited at attempt $i\"\n    break\n  fi\ndone\n\n# Test for unrestricted resource consumption\n# Large pagination\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers?limit=100000&offset=0\" | jq '. | length'\n\n# GraphQL depth\u002Fcomplexity attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { name } } } } } }\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fgraphql\"\n\n# Test SMS\u002Femail flooding via OTP endpoint\nfor i in $(seq 1 20); do\n  curl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"phone\":\"+1234567890\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Fsend-otp\"\ndone\n```\n\n### Step 6: Test API5 - Broken Function Level Authorization\n\nCheck for privilege escalation through administrative endpoints.\n\n```bash\n# Test admin endpoints with regular user token\nADMIN_ENDPOINTS=(\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fsettings\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Flogs\"\n  \"\u002Fapi\u002Fv1\u002Finternal\u002Fconfig\"\n  \"\u002Fapi\u002Fv1\u002Fusers?role=admin\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fexport\"\n)\n\nfor endpoint in \"${ADMIN_ENDPOINTS[@]}\"; do\n  for method in GET POST PUT DELETE; do\n    status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n      -X \"$method\" \\\n      -H \"Authorization: $TOKEN_A\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      \"https:\u002F\u002Fapi.target.example.com$endpoint\")\n    if [ \"$status\" != \"403\" ] && [ \"$status\" != \"401\" ] && [ \"$status\" != \"404\" ]; then\n      echo \"POTENTIAL ISSUE: $method $endpoint returned $status\"\n    fi\n  done\ndone\n\n# Test HTTP method switching\n# If GET \u002Fadmin\u002Fusers returns 403, try:\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n```\n\n### Step 7: Test API7-API10 - SSRF, Misconfiguration, Inventory, and Unsafe Consumption\n\n```bash\n# API7: Server-Side Request Forgery\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"url\":\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Ffetch-url\"\n\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"webhook_url\":\"http:\u002F\u002F127.0.0.1:6379\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fwebhooks\"\n\n# API8: Security Misconfiguration\n# Check CORS policy\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | grep -i \"access-control\"\n\n# Check for verbose error messages\ncurl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\"\n\n# Check security headers\ncurl -s -I \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fhealth\" | grep -iE \\\n  \"(x-frame|x-content|strict-transport|content-security|x-xss)\"\n\n# API9: Improper Inventory Management\n# Test deprecated API versions\nfor v in v0 v1 v2 v3; do\n  curl -s -o \u002Fdev\u002Fnull -w \"$v: %{http_code}\\n\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\"\ndone\n\n# API10: Unsafe Consumption of APIs\n# Test if the API blindly trusts third-party data\n# Check webhook\u002Fcallback implementations for injection\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **BOLA (API1)** | Broken Object Level Authorization - accessing objects belonging to other users |\n| **Broken Authentication (API2)** | Weak authentication mechanisms allowing credential stuffing or token manipulation |\n| **BOPLA (API3)** | Broken Object Property Level Authorization - excessive data exposure or mass assignment |\n| **Unrestricted Resource Consumption (API4)** | Missing rate limiting enabling DoS or brute-force attacks |\n| **Broken Function Level Auth (API5)** | Regular users accessing admin-level API functions |\n| **SSRF (API7)** | Server-Side Request Forgery through API parameters accepting URLs |\n| **Security Misconfiguration (API8)** | Missing security headers, verbose errors, permissive CORS |\n| **Improper Inventory (API9)** | Undocumented, deprecated, or shadow API endpoints left exposed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | API interception, scanning, and manual testing |\n| **Postman** | API collection management and automated test execution |\n| **ffuf** | API endpoint and parameter fuzzing |\n| **Kiterunner** | API endpoint discovery using common API path patterns |\n| **jwt_tool** | JWT token analysis, manipulation, and attack automation |\n| **GraphQL Voyager** | GraphQL schema visualization and introspection analysis |\n| **Arjun** | HTTP parameter discovery for API endpoints |\n\n## Common Scenarios\n\n### Scenario 1: BOLA in E-commerce API\nUser A can access User B's order details by changing the order ID in `\u002Fapi\u002Fv1\u002Forders\u002F{id}`. The API only checks authentication but not authorization on the object level.\n\n### Scenario 2: Mass Assignment on User Profile\nThe user update endpoint accepts a `role` field in the JSON body. By adding `\"role\":\"admin\"` to a profile update request, a regular user escalates to administrator privileges.\n\n### Scenario 3: Deprecated API Version Bypass\nThe `\u002Fapi\u002Fv2\u002Fusers` endpoint has proper rate limiting, but `\u002Fapi\u002Fv1\u002Fusers` (still active) has no rate limiting. Attackers use the old version to brute-force credentials.\n\n### Scenario 4: GraphQL Introspection Data Leak\nGraphQL introspection is enabled in production, exposing the entire schema including internal queries, mutations, and sensitive field names that are not used in the frontend.\n\n## Output Format\n\n```\n## API Security Assessment Report\n\n**Target**: api.target.example.com\n**API Type**: REST (OpenAPI 3.0)\n**Assessment Date**: 2024-01-15\n**OWASP API Security Top 10 (2023) Coverage**\n\n| Risk | Status | Severity | Details |\n|------|--------|----------|---------|\n| API1: BOLA | VULNERABLE | Critical | \u002Fapi\u002Fv1\u002Forders\u002F{id} - IDOR confirmed |\n| API2: Broken Auth | VULNERABLE | High | No rate limit on \u002Fauth\u002Flogin |\n| API3: BOPLA | VULNERABLE | High | User role modifiable via mass assignment |\n| API4: Resource Consumption | VULNERABLE | Medium | No pagination limit enforced |\n| API5: Function Level Auth | PASS | - | Admin endpoints properly restricted |\n| API6: Unrestricted Sensitive Flows | VULNERABLE | Medium | OTP endpoint lacks rate limiting |\n| API7: SSRF | PASS | - | URL parameters properly validated |\n| API8: Misconfiguration | VULNERABLE | Medium | Verbose stack traces in error responses |\n| API9: Improper Inventory | VULNERABLE | Low | API v1 still accessible without docs |\n| API10: Unsafe Consumption | NOT TESTED | - | No third-party API integrations found |\n\n### Critical Finding: BOLA on Orders API\nAuthenticated users can access any order by iterating order IDs.\nTested range: 1-1000, 847 valid orders accessible.\nPII exposure: names, addresses, payment details.\n```\n","# Testing API Security with OWASP Top 10\n\n## When to Use\n\n- During authorized API penetration testing engagements\n- When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities\n- Before deploying new API endpoints to production environments\n- When reviewing API security posture against the OWASP API Security Top 10 (2023)\n- For validating API gateway security controls and rate limiting effectiveness\n\n## Prerequisites\n\n- **Authorization**: Written scope document covering all API endpoints to be tested\n- **Burp Suite Professional**: For intercepting and modifying API requests\n- **Postman**: For organizing and executing API test collections\n- **ffuf**: For API endpoint and parameter fuzzing\n- **curl\u002Fhttpie**: Command-line HTTP clients for manual testing\n- **API documentation**: Swagger\u002FOpenAPI spec, GraphQL schema, or API docs\n- **jq**: JSON processor for parsing API responses (`apt install jq`)\n\n## Workflow\n\n### Step 1: Discover and Map API Endpoints\n\nEnumerate all available API endpoints and understand the API surface.\n\n```bash\n# If OpenAPI\u002FSwagger spec is available, download it\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fswagger.json\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fv2\u002Fapi-docs\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fopenapi.yaml\"\n\n# Fuzz for API endpoints\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,401,403,405 \\\n  -fc 404 \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -o api-enum.json -of json\n\n# Fuzz for API versions\nfor v in v1 v2 v3 v4 beta internal admin; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\")\n  echo \"$v: $status\"\ndone\n\n# Check for GraphQL endpoint\nfor path in graphql graphiql playground query gql; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n```\n\n### Step 2: Test API1 - Broken Object Level Authorization (BOLA)\n\nTest whether users can access objects belonging to other users by manipulating IDs.\n\n```bash\n# Authenticate as User A and get their resources\nTOKEN_A=\"Bearer eyJhbGciOiJIUzI1NiIs...\"\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\u002Forders\" | jq .\n\n# Try accessing User B's resources with User A's token\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F102\u002Forders\" | jq .\n\n# Fuzz object IDs with Burp Intruder or ffuf\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Forders\u002FFUZZ\" \\\n  -w \u003C(seq 1 1000) \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -mc 200 -t 10 -rate 50\n\n# Test IDOR with different ID formats\n# Numeric: \u002Fusers\u002F102\n# UUID: \u002Fusers\u002F550e8400-e29b-41d4-a716-446655440000\n# Encoded: \u002Fusers\u002FMTAy (base64)\n```\n\n### Step 3: Test API2 - Broken Authentication\n\nAssess authentication mechanisms for weaknesses.\n\n```bash\n# Test for missing authentication\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | jq .\n\n# Test JWT token vulnerabilities\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull | jq .\n\n# Test \"alg: none\" attack\n# Header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Create unsigned token with modified claims\n\n# Test brute-force protection on login\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\" \\\n  -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"admin@target.com\",\"password\":\"FUZZ\"}' \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-1000.txt \\\n  -mc 200 -t 5 -rate 10\n\n# Test password reset flow\ncurl -s -X POST \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Freset\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"victim@target.com\"}'\n\n# Check if token is in response body instead of email only\n```\n\n### Step 4: Test API3 - Broken Object Property Level Authorization\n\nTest for excessive data exposure and mass assignment vulnerabilities.\n\n```bash\n# Check for excessive data in responses\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n# Look for: password hashes, SSNs, internal IDs, admin flags, PII\n\n# Test mass assignment - try adding admin properties\ncurl -s -X PUT \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Test User\",\"role\":\"admin\",\"is_admin\":true}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Test with PATCH method\ncurl -s -X PATCH \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"balance\":999999}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Check if filtering parameters expose more data\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?fields=all\" | jq .\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?include=password,ssn\" | jq .\n```\n\n### Step 5: Test API4\u002FAPI6 - Rate Limiting and Unrestricted Access to Sensitive Flows\n\nVerify rate limiting and resource consumption controls.\n\n```bash\n# Test rate limiting on authentication endpoint\nfor i in $(seq 1 100); do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"email\":\"test@test.com\",\"password\":\"wrong\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\")\n  echo \"Attempt $i: $status\"\n  if [ \"$status\" == \"429\" ]; then\n    echo \"Rate limited at attempt $i\"\n    break\n  fi\ndone\n\n# Test for unrestricted resource consumption\n# Large pagination\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers?limit=100000&offset=0\" | jq '. | length'\n\n# GraphQL depth\u002Fcomplexity attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { name } } } } } }\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fgraphql\"\n\n# Test SMS\u002Femail flooding via OTP endpoint\nfor i in $(seq 1 20); do\n  curl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"phone\":\"+1234567890\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Fsend-otp\"\ndone\n```\n\n### Step 6: Test API5 - Broken Function Level Authorization\n\nCheck for privilege escalation through administrative endpoints.\n\n```bash\n# Test admin endpoints with regular user token\nADMIN_ENDPOINTS=(\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fsettings\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Flogs\"\n  \"\u002Fapi\u002Fv1\u002Finternal\u002Fconfig\"\n  \"\u002Fapi\u002Fv1\u002Fusers?role=admin\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fexport\"\n)\n\nfor endpoint in \"${ADMIN_ENDPOINTS[@]}\"; do\n  for method in GET POST PUT DELETE; do\n    status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n      -X \"$method\" \\\n      -H \"Authorization: $TOKEN_A\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      \"https:\u002F\u002Fapi.target.example.com$endpoint\")\n    if [ \"$status\" != \"403\" ] && [ \"$status\" != \"401\" ] && [ \"$status\" != \"404\" ]; then\n      echo \"POTENTIAL ISSUE: $method $endpoint returned $status\"\n    fi\n  done\ndone\n\n# Test HTTP method switching\n# If GET \u002Fadmin\u002Fusers returns 403, try:\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n```\n\n### Step 7: Test API7-API10 - SSRF, Misconfiguration, Inventory, and Unsafe Consumption\n\n```bash\n# API7: Server-Side Request Forgery\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"url\":\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Ffetch-url\"\n\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"webhook_url\":\"http:\u002F\u002F127.0.0.1:6379\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fwebhooks\"\n\n# API8: Security Misconfiguration\n# Check CORS policy\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | grep -i \"access-control\"\n\n# Check for verbose error messages\ncurl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\"\n\n# Check security headers\ncurl -s -I \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fhealth\" | grep -iE \\\n  \"(x-frame|x-content|strict-transport|content-security|x-xss)\"\n\n# API9: Improper Inventory Management\n# Test deprecated API versions\nfor v in v0 v1 v2 v3; do\n  curl -s -o \u002Fdev\u002Fnull -w \"$v: %{http_code}\\n\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\"\ndone\n\n# API10: Unsafe Consumption of APIs\n# Test if the API blindly trusts third-party data\n# Check webhook\u002Fcallback implementations for injection\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **BOLA (API1)** | Broken Object Level Authorization - accessing objects belonging to other users |\n| **Broken Authentication (API2)** | Weak authentication mechanisms allowing credential stuffing or token manipulation |\n| **BOPLA (API3)** | Broken Object Property Level Authorization - excessive data exposure or mass assignment |\n| **Unrestricted Resource Consumption (API4)** | Missing rate limiting enabling DoS or brute-force attacks |\n| **Broken Function Level Auth (API5)** | Regular users accessing admin-level API functions |\n| **SSRF (API7)** | Server-Side Request Forgery through API parameters accepting URLs |\n| **Security Misconfiguration (API8)** | Missing security headers, verbose errors, permissive CORS |\n| **Improper Inventory (API9)** | Undocumented, deprecated, or shadow API endpoints left exposed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | API interception, scanning, and manual testing |\n| **Postman** | API collection management and automated test execution |\n| **ffuf** | API endpoint and parameter fuzzing |\n| **Kiterunner** | API endpoint discovery using common API path patterns |\n| **jwt_tool** | JWT token analysis, manipulation, and attack automation |\n| **GraphQL Voyager** | GraphQL schema visualization and introspection analysis |\n| **Arjun** | HTTP parameter discovery for API endpoints |\n\n## Common Scenarios\n\n### Scenario 1: BOLA in E-commerce API\nUser A can access User B's order details by changing the order ID in `\u002Fapi\u002Fv1\u002Forders\u002F{id}`. The API only checks authentication but not authorization on the object level.\n\n### Scenario 2: Mass Assignment on User Profile\nThe user update endpoint accepts a `role` field in the JSON body. By adding `\"role\":\"admin\"` to a profile update request, a regular user escalates to administrator privileges.\n\n### Scenario 3: Deprecated API Version Bypass\nThe `\u002Fapi\u002Fv2\u002Fusers` endpoint has proper rate limiting, but `\u002Fapi\u002Fv1\u002Fusers` (still active) has no rate limiting. Attackers use the old version to brute-force credentials.\n\n### Scenario 4: GraphQL Introspection Data Leak\nGraphQL introspection is enabled in production, exposing the entire schema including internal queries, mutations, and sensitive field names that are not used in the frontend.\n\n## Output Format\n\n```\n## API Security Assessment Report\n\n**Target**: api.target.example.com\n**API Type**: REST (OpenAPI 3.0)\n**Assessment Date**: 2024-01-15\n**OWASP API Security Top 10 (2023) Coverage**\n\n| Risk | Status | Severity | Details |\n|------|--------|----------|---------|\n| API1: BOLA | VULNERABLE | Critical | \u002Fapi\u002Fv1\u002Forders\u002F{id} - IDOR confirmed |\n| API2: Broken Auth | VULNERABLE | High | No rate limit on \u002Fauth\u002Flogin |\n| API3: BOPLA | VULNERABLE | High | User role modifiable via mass assignment |\n| API4: Resource Consumption | VULNERABLE | Medium | No pagination limit enforced |\n| API5: Function Level Auth | PASS | - | Admin endpoints properly restricted |\n| API6: Unrestricted Sensitive Flows | VULNERABLE | Medium | OTP endpoint lacks rate limiting |\n| API7: SSRF | PASS | - | URL parameters properly validated |\n| API8: Misconfiguration | VULNERABLE | Medium | Verbose stack traces in error responses |\n| API9: Improper Inventory | VULNERABLE | Low | API v1 still accessible without docs |\n| API10: Unsafe Consumption | NOT TESTED | - | No third-party API integrations found |\n\n### Critical Finding: BOLA on Orders API\nAuthenticated users can access any order by iterating order IDs.\nTested range: 1-1000, 847 valid orders accessible.\nPII exposure: names, addresses, payment details.\n```\n",{"cwe":57,"name":5,"tags":59,"capec":63,"model":39,"tools":64,"domain":45,"maxTurns":68,"nist_csf":69,"subdomain":37,"description":7},[58],"CWE-200",[60,46,34,51,61,62,47],"penetration-testing","graphql","burpsuite",[],[65,44,66,67],"Read","Glob","Grep",20,[70,71,72,73],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fapi\u002Fowasp\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill api-owasp-analyze",{"tool":87,"command":88},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill api-owasp-analyze",{"tool":90,"command":91},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill api-owasp-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fowasp\u002Fanalyze\u002FSKILL.md",true,[95],{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"index.json","REFERENCE","参考文档",628,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fowasp\u002Fanalyze\u002Findex.json",[102,125,146,166,188,203],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":52},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[109,110,111,112,113,42,49,114,115,116,117,118,119,120,121,122,123,45,124],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":52},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[132,109,133,112,134,135,136,45,44,137,138,139,140,141,42,142,143,41,144,145],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":52},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[153,154,155,156,157,158,45,44,159,137,33,160,42,41,161,162,163,164,165,39],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":52},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[110,173,174,175,176,177,178,49,179,45,124,180,181,182,183,184,185,186,187,42],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":52},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[195,196,110,197,175,177,198,49,199,179,45,124,137,32,200,201,202,187,42,114],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":52},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[210,110,175,211,198,49,212,213,45,124,214,215,216,217,218,219,42,114,220,221],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]