api-security-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

API Security Review

API安全评审

Perform comprehensive API security assessment following

plays/api-security-review.md

按照

plays/api-security-review.md

执行全面的API安全评估。

Steps

步骤

Discovery & Reconnaissance
- Parse OpenAPI/Swagger specs or scan code for endpoints
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
- Map API gateway and middleware configurations
- Enumerate all API versions and deprecated endpoints
Authentication Deep Dive
- JWT security (algorithm confusion, weak signing, token expiration)
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
- API key exposure and rotation policies
- Session management and token storage
Assess All 10 OWASP API Risks with attack scenarios:
- API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
- API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
- API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
- API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
- API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
- API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
- API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
- API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
- API9 Inventory — Shadow APIs, zombie endpoints, version confusion
- API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
Automated Testing
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
- Test for common vulnerabilities with specific payloads
- Validate rate limiting and throttling mechanisms
API Gateway & Infrastructure Review
- Kong, nginx, Envoy, AWS API Gateway configurations
- WAF rules and bypass opportunities
- TLS configuration and certificate validation

发现与侦察
- 解析OpenAPI/Swagger规范或扫描代码以识别端点
- 确定身份验证机制（JWT、OAuth 2.0、API密钥、mTLS）
- 梳理API网关和中间件配置
- 枚举所有API版本及已弃用的端点
身份验证深度分析
- JWT安全性（算法混淆、弱签名、令牌过期）
- OAuth 2.0流程（PKCE、state参数、重定向URI验证）
- API密钥暴露与轮换策略
- 会话管理与令牌存储
结合攻击场景评估全部10项OWASP API风险：
- API1 BOLA — 通过可预测ID、批量端点绕过、所有权验证漏洞实现的IDOR
- API2 身份验证失效 — JWT攻击、OAuth缺陷、暴力破解、凭证填充
- API3 BOPA — 批量赋值、响应过度暴露、字段级授权绕过
- API4 资源消耗 — 速率限制绕过、分页滥用、GraphQL拒绝服务攻击
- API5 BFLA — 管理员端点发现、横向/纵向权限提升
- API6 业务流程滥用 — 自动化滥用、库存耗尽、爬虫攻击
- API7 SSRF — URL绕过、DNS重绑定、云元数据访问
- API8 配置错误 — CORS绕过、详细错误信息泄露、缺失安全头
- API9 资产未管理 — 影子API、僵尸端点、版本混淆
- API10 不安全的第三方消费 — XXE、反序列化、Webhook重放攻击
自动化测试
- 运行API安全扫描器（OWASP ZAP、Burp Suite、Postman测试）
- 使用特定载荷测试常见漏洞
- 验证速率限制与流量控制机制
API网关与基础设施评审
- Kong、nginx、Envoy、AWS API Gateway配置
- WAF规则及绕过可能性
- TLS配置与证书验证

Output

输出内容

Comprehensive API security report including:

API surface inventory with authentication mechanisms
Risk matrix with severity ratings for all 10 categories
Detailed findings with proof-of-concept examples
Exploit scenarios and business impact analysis
Prioritized remediation roadmap with code examples
Testing artifacts and vulnerability evidence

全面的API安全报告包含：

带身份验证机制的API资产清单
涵盖全部10类风险的风险矩阵及严重等级评定
含概念验证示例的详细发现
攻击场景与业务影响分析
带代码示例的优先级修复路线图
测试工件与漏洞证据

OWASP References

OWASP参考资料

OWASP API Security Top 10 (2023)
OWASP ASVS v5.0 — V13: API and Web Service
OWASP Testing Guide: WSTG-APIT
OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0

OWASP API Security Top 10 (2023)
OWASP ASVS v5.0 — V13: API与Web服务
OWASP测试指南：WSTG-APIT
OWASP Cheat Sheet: REST安全、GraphQL安全、JWT安全、OAuth 2.0