mcpField
A
api-security-review

api-security-review

github.com/owaspSecurity208526 installsUpdated 2w ago
Repository

About api-security-review

A skill for assessing API security through endpoint discovery, authentication review, OWASP API Top 10 testing, and infrastructure checks. It produces findings with evidence and prioritized remediation guidance.

Key features

  1. 01OpenAPI specs and code endpoint discovery
  2. 02JWT, OAuth, API key, and session review
  3. 03Checks for all 10 OWASP API risks
  4. 04Automated scanner and payload testing
  5. 05Gateway, WAF, and TLS configuration review
  6. 06Evidence-backed findings and remediation plan

Use cases

  1. 01Reviewing an API before deployment
  2. 02Investigating authentication and authorization weaknesses
  3. 03Assessing API gateway and infrastructure settings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/owasp/secure-agent-playbook --skill api-security-review

After installing, type/api-security-reviewin Claude Code to confirm it loaded.

Details

From the project README

API Security Review

Perform comprehensive API security assessment following plays/api-security-review.md.

Steps

  1. Discovery & Reconnaissance

    • Parse OpenAPI/Swagger specs or scan code for endpoints
    • Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
    • Map API gateway and middleware configurations
    • Enumerate all API versions and deprecated endpoints

  2. Authentication Deep Dive

    • JWT security (algorithm confusion, weak signing, token expiration)
    • OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
    • API key exposure and rotation policies
    • Session management and token storage

  3. Assess All 10 OWASP API Risks with attack scenarios:

    • API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
    • API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
    • API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
    • API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
    • API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
    • API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
    • API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
    • API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
    • API9 Inventory — Shadow APIs, zombie endpoints, version confusion
    • API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks

  4. Automated Testing

    • Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
    • Test for common vulnerabilities with specific payloads
    • Validate rate limiting and throttling mechanisms

  5. API Gateway & Infrastructure Review

    • Kong, nginx, Envoy, AWS API Gateway configurations
    • WAF rules and bypass opportunities
    • TLS configuration and certificate validation

Output

Comprehensive API security report including:

  • API surface inventory with authentication mechanisms
  • Risk matrix with severity ratings for all 10 categories
  • Detailed findings with proof-of-concept examples
  • Exploit scenarios and business impact analysis
  • Prioritized remediation roadmap with code examples
  • Testing artifacts and vulnerability evidence

OWASP References

  • OWASP API Security Top 10 (2023)
  • OWASP ASVS v5.0 — V13: API and Web Service
  • OWASP Testing Guide: WSTG-APIT
  • OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0

Comments

Markdown supported