Back to Details

api-security-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

API Security Review

API安全评审

Perform comprehensive API security assessment following 
plays/api-security-review.md
.
按照
plays/api-security-review.md
执行全面的API安全评估。

Steps

步骤

  1. Discovery & Reconnaissance
    • Parse OpenAPI/Swagger specs or scan code for endpoints
    • Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
    • Map API gateway and middleware configurations
    • Enumerate all API versions and deprecated endpoints
  2. Authentication Deep Dive
    • JWT security (algorithm confusion, weak signing, token expiration)
    • OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
    • API key exposure and rotation policies
    • Session management and token storage
  3. Assess All 10 OWASP API Risks with attack scenarios:
    • API1 BOLA — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
    • API2 Broken Authentication — JWT attacks, OAuth flaws, brute force, credential stuffing
    • API3 BOPA — Mass assignment, response over-exposure, field-level authz bypasses
    • API4 Resource Consumption — Rate limit bypasses, pagination abuse, GraphQL DoS
    • API5 BFLA — Admin endpoint discovery, horizontal/vertical privilege escalation
    • API6 Business Flows — Automated abuse, inventory exhaustion, scraping attacks
    • API7 SSRF — URL bypasses, DNS rebinding, cloud metadata access
    • API8 Misconfiguration — CORS bypasses, verbose errors, missing headers
    • API9 Inventory — Shadow APIs, zombie endpoints, version confusion
    • API10 Unsafe Consumption — XXE, deserialization, webhook replay attacks
  4. Automated Testing
    • Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
    • Test for common vulnerabilities with specific payloads
    • Validate rate limiting and throttling mechanisms
  5. API Gateway & Infrastructure Review
    • Kong, nginx, Envoy, AWS API Gateway configurations
    • WAF rules and bypass opportunities
    • TLS configuration and certificate validation
  1. 发现与侦察
    • 解析OpenAPI/Swagger规范或扫描代码以识别端点
    • 确定身份验证机制（JWT、OAuth 2.0、API密钥、mTLS）
    • 梳理API网关和中间件配置
    • 枚举所有API版本及已弃用的端点
  2. 身份验证深度分析
    • JWT安全性（算法混淆、弱签名、令牌过期）
    • OAuth 2.0流程（PKCE、state参数、重定向URI验证）
    • API密钥暴露与轮换策略
    • 会话管理与令牌存储
  3. 结合攻击场景评估全部10项OWASP API风险：
    • API1 BOLA — 通过可预测ID、批量端点绕过、所有权验证漏洞实现的IDOR
    • API2 身份验证失效 — JWT攻击、OAuth缺陷、暴力破解、凭证填充
    • API3 BOPA — 批量赋值、响应过度暴露、字段级授权绕过
    • API4 资源消耗 — 速率限制绕过、分页滥用、GraphQL拒绝服务攻击
    • API5 BFLA — 管理员端点发现、横向/纵向权限提升
    • API6 业务流程滥用 — 自动化滥用、库存耗尽、爬虫攻击
    • API7 SSRF — URL绕过、DNS重绑定、云元数据访问
    • API8 配置错误 — CORS绕过、详细错误信息泄露、缺失安全头
    • API9 资产未管理 — 影子API、僵尸端点、版本混淆
    • API10 不安全的第三方消费 — XXE、反序列化、Webhook重放攻击
  4. 自动化测试
    • 运行API安全扫描器（OWASP ZAP、Burp Suite、Postman测试）
    • 使用特定载荷测试常见漏洞
    • 验证速率限制与流量控制机制
  5. API网关与基础设施评审
    • Kong、nginx、Envoy、AWS API Gateway配置
    • WAF规则及绕过可能性
    • TLS配置与证书验证

Output

输出内容

Comprehensive API security report including:
  • API surface inventory with authentication mechanisms
  • Risk matrix with severity ratings for all 10 categories
  • Detailed findings with proof-of-concept examples
  • Exploit scenarios and business impact analysis
  • Prioritized remediation roadmap with code examples
  • Testing artifacts and vulnerability evidence
全面的API安全报告包含：
  • 带身份验证机制的API资产清单
  • 涵盖全部10类风险的风险矩阵及严重等级评定
  • 含概念验证示例的详细发现
  • 攻击场景与业务影响分析
  • 带代码示例的优先级修复路线图
  • 测试工件与漏洞证据

OWASP References

OWASP参考资料

  • OWASP API Security Top 10 (2023)
  • OWASP ASVS v5.0 — V13: API and Web Service
  • OWASP Testing Guide: WSTG-APIT
  • OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0
  • OWASP API Security Top 10 (2023)
  • OWASP ASVS v5.0 — V13: API与Web服务
  • OWASP测试指南：WSTG-APIT
  • OWASP Cheat Sheet: REST安全、GraphQL安全、JWT安全、OAuth 2.0