Test Web And API Security
Overview
Test one scoped property at a time with role-aware accounts and reproducible requests. Use passive observation before active mutation and review automated scanner behavior before it reaches the target.
Read references/web-api-test-plan.md and current OWASP WSTG/API guidance before execution.
Workflow
- Load the approved scope, environment, accounts/roles, data, rate limits, and stop conditions.
- Map the application.
- Record hosts, routes, APIs/schemas, roles, trust boundaries, sessions/tokens, browser controls, uploads, integrations, and state-changing operations.
- Capture a baseline.
- Preserve normal requests/responses and expected authorization for each role and resource owner.
- Test by security property.
- Cover identity/session, object/function authorization, input handling, browser/client boundaries, server-side fetches, files, configuration, errors, data exposure, business logic, and rate/resource controls as scope permits.
- Use tools deliberately.
- Keep proxy/browser history scoped; review ZAP or Nuclei configuration/templates; exclude destructive or broad checks; record exact versions and requests.
- Validate candidates.
- Reproduce with the smallest request, negative control, different role/owner, and fixed/mitigated state when available.
- Clean up.
- Remove test data/accounts/tokens, restore state, and report anything that could not be reverted.
Output
Return scope/accounts, application map, tests and evidence, validated findings, negative results/coverage gaps, cleanup, and retest criteria.
1---2name: test-web-and-api-security3description: Test an authorized web application or API using OWASP guidance. Use for authentication, authorization, sessions, input, schemas, business logic, file handling, server-side requests, configuration, transport, errors, and data exposure.4---56# Test Web And API Security78## Overview910Test one scoped property at a time with role-aware accounts and reproducible requests. Use passive observation before active mutation and review automated scanner behavior before it reaches the target.1112Read [references/web-api-test-plan.md](references/web-api-test-plan.md) and current OWASP WSTG/API guidance before execution.1314## Workflow15161. Load the approved scope, environment, accounts/roles, data, rate limits, and stop conditions.172. Map the application.18 - Record hosts, routes, APIs/schemas, roles, trust boundaries, sessions/tokens, browser controls, uploads, integrations, and state-changing operations.193. Capture a baseline.20 - Preserve normal requests/responses and expected authorization for each role and resource owner.214. Test by security property.22 - Cover identity/session, object/function authorization, input handling, browser/client boundaries, server-side fetches, files, configuration, errors, data exposure, business logic, and rate/resource controls as scope permits.235. Use tools deliberately.24 - Keep proxy/browser history scoped; review ZAP or Nuclei configuration/templates; exclude destructive or broad checks; record exact versions and requests.256. Validate candidates.26 - Reproduce with the smallest request, negative control, different role/owner, and fixed/mitigated state when available.277. Clean up.28 - Remove test data/accounts/tokens, restore state, and report anything that could not be reverted.2930## Output3132Return scope/accounts, application map, tests and evidence, validated findings, negative results/coverage gaps, cleanup, and retest criteria.
gaelic-ghost