mcpField
P
pentest-api-deep

pentest-api-deep

github.com/jd-opensourceSecurity31585 installsUpdated 28w ago
Repository

About pentest-api-deep

pentest-api-deep is an API penetration-testing skill for authorized security testers. It covers multiple OWASP API Security Top 10 (2023) risks through structured discovery, testing, and validation workflows.

Key features

  1. 01API endpoint and hidden parameter discovery
  2. 02BFLA and mass assignment testing
  3. 03Rate limit and resource consumption testing
  4. 04Excessive data exposure checks
  5. 05SSRF and upstream API injection testing
  6. 06API version and deprecated endpoint checks

Use cases

  1. 01Enumerating interfaces from OpenAPI, GraphQL, or gRPC information
  2. 02Comparing API responses across privilege levels
  3. 03Checking API rate limits and complexity controls
  4. 04Testing old API versions and upstream data handling

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-api-deep

After installing, type/pentest-api-deepin Claude Code to confirm it loaded.

Bundled filesreferences/tools.mdreferences/workflows.md

Details

From the project README

Pentest API Deep

Purpose

Perform dedicated API-specific vulnerability testing beyond basic BOLA/GraphQL coverage. Addresses Broken Function Level Authorization (BFLA), mass assignment, rate limiting, excessive data exposure, and unsafe consumption per OWASP API Security Top 10 (2023).

Prerequisites

Authorization Requirements
  • Written authorization with API testing scope explicitly included
  • API documentation (OpenAPI/Swagger specs, GraphQL schema) if available
  • Test accounts at multiple privilege levels (user, admin, service account)
  • Rate limit awareness — confirm acceptable request volume with target owner
Environment Setup
  • Postman or Insomnia for manual API exploration
  • Burp Suite with API-specific extensions
  • GraphQL Voyager for schema visualization
  • grpcurl for gRPC service testing

Core Workflow

  1. API Discovery: Enumerate endpoints via OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, traffic analysis. Discover undocumented endpoints with Kiterunner.
  2. BFLA Testing: Access admin-only API functions as regular user. HTTP method switching (GET→DELETE). Test function-level authorization gaps distinct from object-level (BOLA).
  3. Mass Assignment: Send extra fields in POST/PUT (role, isAdmin, balance). Check response objects for leaked internal fields (WSTG-INPV-20).
  4. Rate Limiting & Resource: Test missing rate limits, GraphQL depth/complexity abuse, pagination abuse, regex DoS via API input.
  5. Excessive Data Exposure: Compare API responses across privilege levels. Identify fields returned but not displayed in UI. Test verbose error responses.
  6. Unsafe Consumption: SSRF through upstream API calls, injection through trusted-but-tainted API response data.
  7. API Versioning: Old API versions with weaker controls, version header manipulation, deprecated endpoint access.

OWASP API Security Top 10 (2023) Coverage

CategoryTest FocusStatus
API1 Broken Object Level AuthorizationIDOR via API params✅
API2 Broken AuthenticationToken/key weaknesses✅
API3 Broken Object Property Level AuthorizationMass assignment, excessive data✅
API4 Unrestricted Resource ConsumptionRate limits, complexity✅
API5 Broken Function Level AuthorizationBFLA, method switching✅
API6 Unrestricted Access to Sensitive Business FlowsAutomation abuse✅
API7 Server Side Request ForgeryAPI-triggered SSRF✅
API8 Security MisconfigurationCORS, headers, versioning✅
API9 Improper Inventory ManagementShadow APIs, deprecated versions✅
API10 Unsafe Consumption of Third-Party APIsUpstream injection✅

Tool Categories

CategoryToolsPurpose
API DiscoveryKiterunner, Swagger UI, GraphQL VoyagerEndpoint enumeration
Parameter DiscoveryArjun, x8, ParamSpiderHidden parameter detection
Fuzzingffuf, Burp Intruder, custom scriptsMass assignment, BFLA
GraphQLgraphql-cop, InQL, BatchQLGraphQL-specific attacks
gRPCgrpcurl, grpc-toolsgRPC reflection and testing
Rate Testingcustom aiohttp scripts, Turbo IntruderRate limit verification

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Comments

Markdown supported