1---2name: pentest-api-deep3description: Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.4---56# Pentest API Deep78## Purpose9Perform dedicated API-specific vulnerability testing beyond basic BOLA/GraphQL coverage. Addresses Broken Function Level Authorization (BFLA), mass assignment, rate limiting, excessive data exposure, and unsafe consumption per OWASP API Security Top 10 (2023).1011## Prerequisites1213### Authorization Requirements14- **Written authorization** with API testing scope explicitly included15- **API documentation** (OpenAPI/Swagger specs, GraphQL schema) if available16- **Test accounts** at multiple privilege levels (user, admin, service account)17- **Rate limit awareness** — confirm acceptable request volume with target owner1819### Environment Setup20- Postman or Insomnia for manual API exploration21- Burp Suite with API-specific extensions22- GraphQL Voyager for schema visualization23- grpcurl for gRPC service testing2425## Core Workflow261. **API Discovery**: Enumerate endpoints via OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, traffic analysis. Discover undocumented endpoints with Kiterunner.272. **BFLA Testing**: Access admin-only API functions as regular user. HTTP method switching (GET→DELETE). Test function-level authorization gaps distinct from object-level (BOLA).283. **Mass Assignment**: Send extra fields in POST/PUT (role, isAdmin, balance). Check response objects for leaked internal fields (WSTG-INPV-20).294. **Rate Limiting & Resource**: Test missing rate limits, GraphQL depth/complexity abuse, pagination abuse, regex DoS via API input.305. **Excessive Data Exposure**: Compare API responses across privilege levels. Identify fields returned but not displayed in UI. Test verbose error responses.316. **Unsafe Consumption**: SSRF through upstream API calls, injection through trusted-but-tainted API response data.327. **API Versioning**: Old API versions with weaker controls, version header manipulation, deprecated endpoint access.3334## OWASP API Security Top 10 (2023) Coverage3536| Category | Test Focus | Status |37|----------|-----------|--------|38| API1 Broken Object Level Authorization | IDOR via API params | ✅ |39| API2 Broken Authentication | Token/key weaknesses | ✅ |40| API3 Broken Object Property Level Authorization | Mass assignment, excessive data | ✅ |41| API4 Unrestricted Resource Consumption | Rate limits, complexity | ✅ |42| API5 Broken Function Level Authorization | BFLA, method switching | ✅ |43| API6 Unrestricted Access to Sensitive Business Flows | Automation abuse | ✅ |44| API7 Server Side Request Forgery | API-triggered SSRF | ✅ |45| API8 Security Misconfiguration | CORS, headers, versioning | ✅ |46| API9 Improper Inventory Management | Shadow APIs, deprecated versions | ✅ |47| API10 Unsafe Consumption of Third-Party APIs | Upstream injection | ✅ |4849## Tool Categories5051| Category | Tools | Purpose |52|----------|-------|---------|53| API Discovery | Kiterunner, Swagger UI, GraphQL Voyager | Endpoint enumeration |54| Parameter Discovery | Arjun, x8, ParamSpider | Hidden parameter detection |55| Fuzzing | ffuf, Burp Intruder, custom scripts | Mass assignment, BFLA |56| GraphQL | graphql-cop, InQL, BatchQL | GraphQL-specific attacks |57| gRPC | grpcurl, grpc-tools | gRPC reflection and testing |58| Rate Testing | custom aiohttp scripts, Turbo Intruder | Rate limit verification |5960## References61- `references/tools.md` - Tool function signatures and parameters62- `references/workflows.md` - Attack pattern definitions and test vectors
jd-opensource