Back to Details

offensive-api-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

REST, GraphQL & gRPC API Security Audit (
offensive-api-security
)

REST、GraphQL 与 gRPC API 安全审计（
offensive-api-security
）

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.
授权与范围声明： 本 skill 属于 REA_Skill + claude-red 统一安全与逆向工程套件。它严格适用于在你拥有或已获得明确测试许可的软件、基础设施和资产上，进行授权安全评估、防御性架构评审、漏洞分级、漏洞赏金验证以及修复工程。

Overview

概述

Comprehensive OWASP API Security Top 10 auditing across REST, GraphQL, gRPC, and WebSocket APIs covering object/function-level authorization, mass assignment, OpenAPI schema validation, and token-bucket rate limiting.
对 REST、GraphQL、gRPC 与 WebSocket API 开展全面的 OWASP API Security Top 10 审计，涵盖对象级/功能级授权、批量赋值（Mass Assignment）、OpenAPI schema 校验以及令牌桶限流。

Operational Workflow

操作流程

  1. Surface & Architecture Inventory
    • Identify all entrypoints, trust boundaries, parsers, and configuration files relevant to REST, GraphQL & gRPC API Security Audit (
      api
      domain).
    • Combine static code/binary inspection (via REA MCP tools, 
      rg
      , AST analysis, or decompilation) with runtime configuration verification.
  2. Hypothesis & Vulnerability Verification
    • Test each security invariant systematically against known CWE and OWASP patterns.
    • Record concrete evidence: affected file/procedure, line numbers or binary offsets, request/response trace, and root cause.
  3. Impact & Reachability Triage
    • Evaluate whether the issue is reachable across trust boundaries, whether defense-in-depth controls mitigate it, and compute an accurate CVSS v3.1 / v4.0 score.
  4. Remediation & Regression Verification
    • Implement or provide production-ready, copy-pasteable remediation code.
    • Write an automated regression test or verification command to prove the flaw is resolved with 0 regressions.
  1. 攻击面与架构梳理
    • 识别与 REST、GraphQL 与 gRPC API 安全审计（
      api
      领域）相关的所有入口点、信任边界、解析器（parser）与配置文件。
    • 将静态代码/二进制检查（通过 REA MCP 工具、
      rg
      、AST 分析或反编译）与运行时配置验证相结合。
  2. 假设与漏洞验证
    • 针对已知的 CWE 与 OWASP 模式，系统性地检验每一条安全不变量。
    • 记录具体证据：受影响的文件/过程、行号或二进制偏移量、请求/响应追踪以及根因。
  3. 影响与可达性分级
    • 评估该问题是否可跨信任边界触达、纵深防御控制能否有效缓解，并计算准确的 CVSS v3.1 / v4.0 评分。
  4. 修复与回归验证
    • 实施或提供生产级、可直接复制粘贴的修复代码。
    • 编写自动化回归测试或验证命令，证明缺陷已被修复且实现 0 回归。

Audit & Verification Checklist

审计与验证清单

PhaseCheckVerification MethodExpected Secure State
1. DiscoveryEnumerate all 
api
surfaces and dependencies		Source search / REA binary & bundle inspectionComplete inventory of trust boundaries
2. Input & StateValidate parser behavior, type safety, and state transitionsBoundary testing & static taint analysisStrict schema validation and invariant checks
3. Auth & IsolationVerify caller identity, tenant isolation, and least privilegeHorizontal/vertical privilege matrix checkExplicit deny-by-default enforcement
4. Defense-in-DepthInspect secondary controls, logging, and compiler/runtime flagsConfig & header/binary flag auditFull hardening and telemetry enabled
5. RemediationApply fix and execute automated regression test
npm test
/ toolchain build & test suite		0 vulnerabilities, 0 build errors
阶段检查项验证方法期望的安全状态
1. 发现枚举所有 
api
攻击面与依赖		源码检索 / REA 二进制与 bundle 检查完整的信任边界清单
2. 输入与状态校验解析器行为、类型安全与状态转换边界测试与静态污点分析严格的 schema 校验与不变量检查
3. 认证与隔离验证调用方身份、租户隔离与最小权限水平/垂直权限矩阵检查显式的默认拒绝（deny-by-default）执行
4. 纵深防御检查次级控制措施、日志记录与编译器/运行时标志配置与 header/binary 标志审计全面加固并启用遥测
5. 修复应用修复并执行自动化回归测试
npm test
/ 工具链构建与测试套件		0 漏洞，0 构建错误

Integration with REA MCP & Tooling

与 REA MCP 及工具链的集成

  • Static & Binary Analysis: Pair with 
    rea-universal-orchestrator
    , 
    rea-binary-disassembly
    , 
    rea-web-bundle-recovery
    , or 
    rea-mobile-app-recovery
    when source code is unavailable.
  • Interactive Scoping: Invoke 
    /rea-grill-me
    before large-scale assessments to clarify scope, target environments, and acceptance criteria.
  • Reporting: Pair with 
    offensive-reporting
    to format findings with CVSS vectors, CWE mappings, and remediation patches.
  • 静态与二进制分析： 当源代码不可用时，与 
    rea-universal-orchestrator
    、
    rea-binary-disassembly
    、
    rea-web-bundle-recovery
    或 
    rea-mobile-app-recovery
    配合使用。
  • 交互式范围界定： 在开展大规模评估之前，调用 
    /rea-grill-me
    以明确评估范围、目标环境与验收标准。
  • 报告： 与 
    offensive-reporting
    配合，将发现整理为包含 CVSS 向量、CWE 映射和修复补丁的规范格式。