Vapt API

API Security Testing

When Invoked

The user runs /vapt api <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Prerequisites

Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered API endpoints
• If VAPT-SCAN.md exists -> extract API paths from scan results
• If no context -> discover API endpoints via common paths

Phase 1: API Discovery

1.1 OpenAPI / Swagger Detection

# Common OpenAPI spec locations
for path in /swagger.json /swagger-ui /openapi.json /api-docs /api/v1/swagger.json /api/docs /v1/api-docs /v2/api-docs /api/swagger /docs/api; do
    code=$(curl -s -o /dev/null -w "%{http_code}" <url>$path)
    [ "$code" != "404" ] && echo "Found: $path ($code)"
done

If a spec file is found, parse it to extract all endpoints, methods, and parameters.

1.2 GraphQL Detection

# Common GraphQL endpoints
for path in /graphql /graphiql /v1/graphql /api/graphql /query; do
    code=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d '{"query":"{__typename}"}' <url>$path)
    [ "$code" = "200" ] && echo "GraphQL found: $path"
done

1.3 API Endpoint Fuzzing

If kiterunner is installed:

kr scan <url> -w /path/to/routes-large.kite

If ffuf is installed:

ffuf -u <url>/api/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,201,401,403

Fallback: Check common API path patterns:

/api, /api/v1, /api/v2, /api/v3
/api/users, /api/admin, /api/config
/api/health, /api/status, /api/metrics
/api/search, /api/export, /api/import

Phase 2: Authentication Testing

2.1 Unauthenticated Access

Test all discovered endpoints without authentication:

for endpoint in <discovered_endpoints>; do
    echo "$endpoint: $(curl -s -o /dev/null -w '%{http_code}' <url>$endpoint)"
done

Endpoints that return 200 without auth may be misconfigured.

2.2 API Key / Token Analysis

If API keys are used:

• Check if keys are in URLs (leakable via logs/referrer)
• Check key rotation / expiration
• Test with expired or revoked keys
• Check rate limiting per key

Phase 3: BOLA / BFLA Testing

3.1 Broken Object Level Authorization (BOLA)

OWASP API #1 -- test each data-accessing endpoint:

# Access resource as user A
curl -s -H "Authorization: Bearer <user_A_token>" <url>/api/orders/123

# Try to access user B's resource with user A's token
curl -s -H "Authorization: Bearer <user_A_token>" <url>/api/orders/456

Test on all CRUD operations (GET, PUT/PATCH, DELETE).

3.2 Broken Function Level Authorization (BFLA)

OWASP API #5 -- test if regular users can access admin API functions:

# Admin endpoints with regular user token
curl -s -H "Authorization: Bearer <regular_token>" <url>/api/admin/users
curl -s -H "Authorization: Bearer <regular_token>" -X DELETE <url>/api/users/other_user_id
curl -s -H "Authorization: Bearer <regular_token>" -X POST <url>/api/admin/settings

3.3 Scoring

Phase 4: Mass Assignment & Data Exposure

4.1 Mass Assignment

Test if extra fields in request body are accepted:

# Try adding fields that shouldn't be user-controllable
curl -s -X PUT -H "Authorization: Bearer <token>" \
    -H "Content-Type: application/json" \
    -d '{"name":"test","role":"admin","is_admin":true,"credits":999999}' \
    <url>/api/users/profile

4.2 Excessive Data Exposure

Check if API responses include more data than needed:

• Internal IDs
• Email addresses of other users
• Password hashes
• Internal system information
• Debug data

curl -s -H "Authorization: Bearer <token>" <url>/api/users | python3 -m json.tool

4.3 Scoring

Phase 5: Rate Limiting & Resource Consumption

5.1 Rate Limit Testing

# Send 50 rapid requests and check for throttling
for i in $(seq 1 50); do
    echo "Request $i: $(curl -s -o /dev/null -w '%{http_code}' <url>/api/endpoint)"
done

Check: Are 429 responses returned? At what threshold?

5.2 Resource Consumption

Test for:

• Large payload acceptance (send 10MB+ JSON body)
• Pagination abuse (request page_size=999999)
• Unbound list endpoints (no default limit)
• Expensive operations without throttling

5.3 Scoring

Phase 6: GraphQL-Specific Testing

If GraphQL endpoint was discovered:

6.1 Introspection

curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{__schema{types{name fields{name}}}}"}' \
    <url>/graphql

If introspection is enabled in production -> Medium finding.

6.2 Nested Query Depth

Test for query depth limits:

{ user { friends { friends { friends { friends { id } } } } } }

No depth limit = potential denial of service.

6.3 Batching Attacks

# Send multiple queries in a single request
curl -s -X POST -H "Content-Type: application/json" \
    -d '[{"query":"{user(id:1){name}}"},{"query":"{user(id:2){name}}"},...]' \
    <url>/graphql

Can be used to bypass rate limiting.

6.4 Scoring

Phase 7: Input Validation

7.1 Type Coercion

Send unexpected types for known parameters:

# Number field with string
curl -s -X POST -d '{"id":"string_instead_of_number"}' <url>/api/resource

# String field with array
curl -s -X POST -d '{"name":["array","instead"]}' <url>/api/resource

# Boolean field with object
curl -s -X POST -d '{"active":{"$gt":""}}' <url>/api/resource

7.2 Special Characters

Test with: null bytes, unicode, very long strings, negative numbers, floating point edge cases (NaN, Infinity), empty strings, empty objects/arrays.

Phase 8: Output

Terminal Output

Dev mode: Explain OWASP API Top 10, what BOLA/BFLA means, why mass assignment happens.

Pro mode: Endpoint matrix and findings table.

VAPT-API.md

# VAPT API Security Report

## Target: <url>
## Date: <timestamp>

## API Discovery
| Endpoint | Method | Auth Required | Status |
|----------|--------|--------------|--------|
| ... | ... | ... | ... |

## OpenAPI / Swagger
<spec location and exposure status>

## GraphQL
<introspection results, schema summary>

## BOLA / BFLA
<access control testing results>

## Mass Assignment
<mass assignment testing results>

## Data Exposure
<excessive data in responses>

## Rate Limiting
<rate limit testing results>

## Findings
<scored findings table>

## Suggested Next Steps
- /vapt inject <url> -- test API parameters for injections
- /vapt authz <url> -- deeper access control testing
- /vapt report <url> -- compile full report

Cross-Skill Integration

• API findings weight 12% in Security Posture Score
• Discovered API endpoints expand scope for vapt-inject
• BOLA findings overlap with vapt-authz IDOR testing