api-security-testing

Original：🇨🇳 Chinese

Translated

Professional Skills and Methodologies for API Security Testing

1installs

Sourceed1s0nz/cyberstrikeai

Added on2026-02-07

NPX Install

npx skill4agent add ed1s0nz/cyberstrikeai api-security-testing

SKILL.md Content (Chinese)

View Translation Comparison →

API Security Testing

Overview

API security testing is a critical step to ensure the security of API interfaces. This skill provides methods, tools, and best practices for API security testing.

Testing Scope

1. Authentication and Authorization

Test Items:

Token validity verification
Token expiration handling
Permission control
Role permission verification

2. Input Validation

Test Items:

Parameter type verification
Data length restrictions
Special character handling
SQL injection protection
XSS protection

3. Business Logic

Test Items:

Workflow verification
State transition
Concurrency control
Business rules

4. Error Handling

Test Items:

Error information leakage
Stack trace exposure
Sensitive information disclosure

Testing Methods

1. API Discovery

Identify API Endpoints:

bash

# 使用目录扫描
gobuster dir -u https://target.com -w api-wordlist.txt

# 使用Burp Suite被动扫描
# 浏览应用，观察API调用

# 分析JavaScript文件
# 查找API端点定义

2. Authentication Testing

Token Testing:

http

# 测试无效Token
GET /api/user
Authorization: Bearer invalid_token

# 测试过期Token
GET /api/user
Authorization: Bearer expired_token

# 测试无Token
GET /api/user

JWT Testing:

bash

# 使用jwt_tool
python jwt_tool.py <JWT_TOKEN>

# 测试算法混淆
python jwt_tool.py <JWT_TOKEN> -X a

# 测试密钥暴力破解
python jwt_tool.py <JWT_TOKEN> -C -d wordlist.txt

3. Authorization Testing

Horizontal Privilege:

http

# 用户A访问用户B的资源
GET /api/user/123
Authorization: Bearer user_a_token

# 应该返回403

Vertical Privilege:

http

# 普通用户访问管理员接口
GET /api/admin/users
Authorization: Bearer user_token

# 应该返回403

4. Input Validation Testing

SQL Injection:

http

POST /api/search
{
  "query": "test' OR '1'='1"
}

Command Injection:

http

POST /api/execute
{
  "command": "ping; id"
}

XXE:

http

POST /api/parse
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

5. Rate Limiting Testing

Test Rate Limiting:

python

import requests

for i in range(1000):
    response = requests.get('https://target.com/api/endpoint')
    print(f"Request {i}: {response.status_code}")

Tool Usage

Postman

Create Test Collections:

Import API documentation
Configure authentication
Create test cases
Run automated tests

Burp Suite

API Scanning:

Configure API endpoints
Set up authentication
Run active scan
Analyze results

OWASP ZAP

bash

# API扫描
zap-cli quick-scan --self-contained \
  --start-options '-config api.disablekey=true' \
  http://target.com/api

REST-Attacker

bash

# 扫描OpenAPI规范
rest-attacker scan openapi.yaml

Common Vulnerabilities

1. Authentication Bypass

Token Verification Flaws:

Weak token generation
Predictable tokens
Token signature not verified

2. Privilege Escalation

IDOR:

Insecure Direct Object References
Unverified resource ownership

3. Information Disclosure

Error Messages:

Detailed error messages
Stack traces
Sensitive data exposure

4. Injection Vulnerabilities

Common Injections:

SQL injection
NoSQL injection
Command injection
XXE

5. Business Logic

Logic Flaws:

Price manipulation
Quantity restriction bypass
State modification

Test Checklist

Authentication Testing

Token validity verification
Token expiration handling
Weak token detection
Token replay attack

Authorization Testing

Horizontal privilege testing
Vertical privilege testing
Role permission verification
Resource access control

Input Validation

SQL injection testing
XSS testing
Command injection testing
XXE testing
Parameter pollution

Business Logic

Workflow verification
State transition
Concurrency control
Business rules

Error Handling

Error information leakage
Stack trace exposure
Sensitive information disclosure

Protection Measures

Notes

Only conduct in authorized testing environments
Avoid impacting API services
Note differences between different API versions
Pay attention to request frequency during testing

api-security-testing

NPX Install

Tags

SKILL.md Content (Chinese)

API Security Testing

Overview

Testing Scope

1. Authentication and Authorization

2. Input Validation

3. Business Logic

4. Error Handling

Testing Methods

1. API Discovery

2. Authentication Testing

3. Authorization Testing

4. Input Validation Testing

5. Rate Limiting Testing

Tool Usage

Postman

Burp Suite

OWASP ZAP

REST-Attacker

Common Vulnerabilities

1. Authentication Bypass

2. Privilege Escalation

3. Information Disclosure

4. Injection Vulnerabilities

5. Business Logic

Test Checklist

Authentication Testing

Authorization Testing

Input Validation

Business Logic

Error Handling

Protection Measures

Recommended Solutions

Notes