pentest-api
REST + GraphQL + WebSocket guvenlik testi methodology. OWASP API Security Top 10 (2023) odakli.
Triggers
- "API pentest"
- "OWASP API Top 10"
- "GraphQL introspection"
- "JWT swap denemesi"
- "OAuth flow test"
- "BOLA / BFLA"
- "mass assignment"
- "WebSocket guvenlik"
OWASP API Top 10 (2023)
| # |
Kategori |
Test Yaklasimi |
| API1 |
BOLA (Broken Object Level Auth) |
/users/123 -> /users/124 enum, yetkisiz veri erisimi |
| API2 |
Broken Authentication |
Token replay, JWT manipulation, brute force endpoint |
| API3 |
Broken Object Property Level Auth |
Mass assignment (admin: true), excessive exposure |
| API4 |
Unrestricted Resource Consumption |
Rate limit eksik, pagination size, file upload size |
| API5 |
BFLA (Broken Function Level Auth) |
/admin/* user role ile erisilir mi |
| API6 |
Unrestricted Business Flows |
Bizlogic exploit (pentest-bizlogic'e devret) |
| API7 |
SSRF |
URL parametre cloud metadata reach |
| API8 |
Security Misconfig |
Verbose error, CORS *, default endpoint |
| API9 |
Improper Inventory |
v1/v2 ayni endpoint farkli auth, shadow API |
| API10 |
Unsafe Consumption of 3rd Party API |
API anahtari exfil, response trust |
REST Test Methodology
1. Spec dokuman bul: /swagger.json, /openapi.yaml, /api-docs
2. Endpoint listele + auth gereksinimleri
3. BOLA: numeric ID enum (user_id, doc_id, order_id)
4. BFLA: rol degisikligi (cookie/header swap)
5. Rate limit: 100 istek/sn 60sn icinde
6. CORS: Origin: evil.com -> reflect?
7. Verbose error: malformed body, sql-like input
GraphQL Test
# Introspection check (QUIET)
curl -X POST https://<hedef>/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'
# Common queries
- Field suggestion (typo) -> auto-suggest reveal
- Batching: tek POST'ta 1000 query (DoS hazirlik testi)
- Alias overloading
- Deep nesting: { user { friend { friend { ... } } } } depth 10+
JWT Analiz
| Test |
Yaklasim |
| alg: none |
Header'i {"alg":"none","typ":"JWT"} yap, imzayi sil |
| alg confusion |
RS256 -> HS256, public key'i secret olarak kullan |
| kid injection |
kid: ../../../dev/null (SQL kid varsa SQLi) |
| exp ignore |
exp gecmis, server yine de kabul ediyor mu |
| Weak secret |
hashcat ile JWT secret crack (offline) |
# QUIET — decode only (hicbir hedefe istek yok)
echo "<token>" | python3 -c "import sys,jwt; print(jwt.decode(sys.stdin.read().strip(), options={'verify_signature': False}))"
OAuth Flow Test
- redirect_uri tampering: evil.com'a token gonderme
- state parameter eksik -> CSRF
- response_type=token (implicit) hala destekleniyor mu
- PKCE eksik (mobile/SPA icin zorunlu)
- scope creep: minimal scope iste, max scope geldi mi
- Refresh token rotation eksik
Mass Assignment Test
POST /api/users
Content-Type: application/json
{
"name": "test",
"email": "test@example.com",
"isAdmin": true, # mass assignment
"subscription": "premium" # mass assignment
}
Response'da isAdmin: true donerse zafiyet var.
WebSocket
- Origin header validation eksik mi (CSRF-like)
- Authentication tek handshake'te mi (mid-session re-auth?)
- Message size limit
- Binary message + WS Frame manipulation
Output Sablonu
## API Analiz — <baseURL>
### Bulgu
- [HIGH] BOLA in GET /api/orders/{id} — user A, user B siparisini gorebiliyor
- [MEDIUM] GraphQL introspection production'da acik
- [LOW] CORS Origin reflection (sadece null origin)
### Test Edilmemis Alanlar
- BFLA admin endpoint (admin token yok)
- WebSocket /ws — handshake test edilmedi
- Rate limit thresholdu (musteri test penceresi disinda)
Out-of-Scope
- Live brute force (pentest-credentials)
- DDoS via rate limit absent
- Token replay attack saglayan automated tool
1---2name: pentest-api3description: API security testing — REST/GraphQL/WebSocket, OWASP API Top 10, JWT/OAuth analiz, mass assignment, broken object-level authorization advisory. Triggers on API pentest, OWASP API, REST security, GraphQL test, WebSocket, JWT analysis, OAuth flow, BOLA, BFLA, mass assignment.4license: MIT5---67# pentest-api89REST + GraphQL + WebSocket guvenlik testi methodology. OWASP API Security Top 10 (2023) odakli.1011## Triggers1213- "API pentest"14- "OWASP API Top 10"15- "GraphQL introspection"16- "JWT swap denemesi"17- "OAuth flow test"18- "BOLA / BFLA"19- "mass assignment"20- "WebSocket guvenlik"2122## OWASP API Top 10 (2023)2324| # | Kategori | Test Yaklasimi |25|---|----------|---------------|26| API1 | BOLA (Broken Object Level Auth) | /users/123 -> /users/124 enum, yetkisiz veri erisimi |27| API2 | Broken Authentication | Token replay, JWT manipulation, brute force endpoint |28| API3 | Broken Object Property Level Auth | Mass assignment (admin: true), excessive exposure |29| API4 | Unrestricted Resource Consumption | Rate limit eksik, pagination size, file upload size |30| API5 | BFLA (Broken Function Level Auth) | /admin/* user role ile erisilir mi |31| API6 | Unrestricted Business Flows | Bizlogic exploit (pentest-bizlogic'e devret) |32| API7 | SSRF | URL parametre cloud metadata reach |33| API8 | Security Misconfig | Verbose error, CORS *, default endpoint |34| API9 | Improper Inventory | v1/v2 ayni endpoint farkli auth, shadow API |35| API10 | Unsafe Consumption of 3rd Party API | API anahtari exfil, response trust |3637## REST Test Methodology3839```401. Spec dokuman bul: /swagger.json, /openapi.yaml, /api-docs412. Endpoint listele + auth gereksinimleri423. BOLA: numeric ID enum (user_id, doc_id, order_id)434. BFLA: rol degisikligi (cookie/header swap)445. Rate limit: 100 istek/sn 60sn icinde456. CORS: Origin: evil.com -> reflect?467. Verbose error: malformed body, sql-like input47```4849## GraphQL Test5051```bash52# Introspection check (QUIET)53curl -X POST https://<hedef>/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'5455# Common queries56- Field suggestion (typo) -> auto-suggest reveal57- Batching: tek POST'ta 1000 query (DoS hazirlik testi)58- Alias overloading59- Deep nesting: { user { friend { friend { ... } } } } depth 10+60```6162## JWT Analiz6364| Test | Yaklasim |65|------|----------|66| alg: none | Header'i `{"alg":"none","typ":"JWT"}` yap, imzayi sil |67| alg confusion | RS256 -> HS256, public key'i secret olarak kullan |68| kid injection | `kid: ../../../dev/null` (SQL kid varsa SQLi) |69| exp ignore | exp gecmis, server yine de kabul ediyor mu |70| Weak secret | hashcat ile JWT secret crack (offline) |7172```bash73# QUIET — decode only (hicbir hedefe istek yok)74echo "<token>" | python3 -c "import sys,jwt; print(jwt.decode(sys.stdin.read().strip(), options={'verify_signature': False}))"75```7677## OAuth Flow Test7879- redirect_uri tampering: evil.com'a token gonderme80- state parameter eksik -> CSRF81- response_type=token (implicit) hala destekleniyor mu82- PKCE eksik (mobile/SPA icin zorunlu)83- scope creep: minimal scope iste, max scope geldi mi84- Refresh token rotation eksik8586## Mass Assignment Test8788```http89POST /api/users90Content-Type: application/json9192{93 "name": "test",94 "email": "test@example.com",95 "isAdmin": true, # mass assignment96 "subscription": "premium" # mass assignment97}98```99100Response'da `isAdmin: true` donerse zafiyet var.101102## WebSocket103104- Origin header validation eksik mi (CSRF-like)105- Authentication tek handshake'te mi (mid-session re-auth?)106- Message size limit107- Binary message + WS Frame manipulation108109## Output Sablonu110111```markdown112## API Analiz — <baseURL>113114### Bulgu115- [HIGH] BOLA in GET /api/orders/{id} — user A, user B siparisini gorebiliyor116- [MEDIUM] GraphQL introspection production'da acik117- [LOW] CORS Origin reflection (sadece null origin)118119### Test Edilmemis Alanlar120- BFLA admin endpoint (admin token yok)121- WebSocket /ws — handshake test edilmedi122- Rate limit thresholdu (musteri test penceresi disinda)123```124125## Out-of-Scope126127- Live brute force (pentest-credentials)128- DDoS via rate limit absent129- Token replay attack saglayan automated tool
aibot88