# Implementing API Security Testing With 42crunch > 使用42Crunch平台实施全面的API安全测试，对OpenAPI规范执行静态审计（Static Audit）和动态合规扫描（Conformance Scanning）。 - Skill: `killvxk/implementing-api-security-testing-with-42crunch` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add killvxk/implementing-api-security-testing-with-42crunch` - Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/implementing-api-security-testing-with-42crunch/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - License: Apache-2.0 - Author: killvxk (https://skillmd.com/u/killvxk) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/killvxk/implementing-api-security-testing-with-42crunch --- # 使用42Crunch实施API安全测试 ## 概述 42Crunch是一个API安全平台，将安全左移（Shift-Left）测试与运行时防护（Shield-Right）相结合。它提供API Audit（API审计）用于OpenAPI定义的静态安全分析，API Conformance Scan（API合规扫描）用于动态漏洞检测，以及API Protect（API防护）用于实时威胁防护。该平台集成到CI/CD流水线和IDE中，在部署前后识别OWASP API安全Top 10漏洞。 ## 前置条件 - 42Crunch平台账号（评估可用免费版） - 目标API的OpenAPI规范（OAS）v2.0、v3.0或v3.1定义 - 带42Crunch扩展的IDE（VS Code、IntelliJ或Eclipse） - CI/CD流水线（Jenkins、GitHub Actions、Azure DevOps或GitLab CI） - 动态扫描（合规扫描）需要运行中的API实例 - CLI工具需要Node.js或Python环境 ## 核心概念 ### API Audit（静态分析） API Audit无需运行中的API即可对OpenAPI定义执行静态安全分析。它按类别对规范进行300+项安全检查： **安全评分类别：** - **数据验证（Data Validation）**：Schema定义、参数约束、响应验证 - **认证（Authentication）**：安全方案定义、范围要求 - **传输安全（Transport Security）**：服务器URL scheme、TLS要求 - **错误处理（Error Handling）**：错误响应定义、信息泄露防护 **通过VS Code扩展运行API Audit：** 1. 从VS Code市场安装42Crunch扩展 2. 打开OpenAPI规范文件（YAML或JSON） 3. 点击编辑器工具栏中的安全审计图标 4. 查看安全分数（0-100）和各项发现 5. 使用内联修复指导处理问题 **带安全控制的OpenAPI定义示例：** ```yaml openapi: 3.0.3 info: title: Secure User API version: 1.0.0 servers: - url: https://api.example.com/v1 description: Production server (HTTPS only) security: - BearerAuth: [] paths: /users/{userId}: get: operationId: getUserById summary: Retrieve user by ID parameters: - name: userId in: path required: true schema: type: string format: uuid pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' maxLength: 36 responses: '200': description: User details content: application/json: schema: $ref: '#/components/schemas/User' '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthorized '404': description: User not found components: securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT schemas: User: type: object required: - id - email properties: id: type: string format: uuid readOnly: true email: type: string format: email maxLength: 254 name: type: string maxLength: 100 pattern: '^[a-zA-Z\s\-]+$' additionalProperties: false Error: type: object required: - code - message properties: code: type: integer format: int32 message: type: string maxLength: 256 additionalProperties: false ``` ### API Conformance Scan（动态测试） 合规扫描对运行中的API进行动态测试，验证其是否符合OpenAPI契约，检测运行时漏洞（包括OWASP API安全Top 10问题）： **Scan v2配置：** ```yaml # 42c-conf.yaml version: "2.0" scan: target: url: https://api.example.com/v1 authentication: - type: bearer token: "${API_TOKEN}" in: header name: Authorization settings: maxScanTime: 3600 requestsPerSecond: 10 followRedirects: false tests: owasp: - bola - bfla - injection - ssrf - massAssignment - excessiveDataExposure ``` **通过CLI运行合规扫描：** ```bash # 安装42Crunch CLI npm install -g @42crunch/cicd-cli # 运行合规扫描 42crunch-cli scan \ --api-definition ./openapi.yaml \ --target-url https://api.example.com/v1 \ --token $CRUNCH_TOKEN \ --min-score 70 \ --report-format sarif \ --output scan-report.sarif ``` ### CI/CD流水线集成 **GitHub Actions集成：** ```yaml name: API Security Testing on: push: paths: - 'api/**' - 'openapi/**' jobs: api-security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: 42Crunch API审计 uses: 42Crunch/api-security-audit-action@v3 with: api-token: ${{ secrets.CRUNCH_API_TOKEN }} collection-name: "my-api-collection" min-score: 75 upload-to-code-scanning: true - name: 42Crunch合规扫描 if: github.ref == 'refs/heads/main' uses: 42Crunch/api-conformance-scan@v1 with: api-token: ${{ secrets.CRUNCH_API_TOKEN }} target-url: ${{ secrets.STAGING_API_URL }} scan-config: ./42c-conf.yaml ``` **Jenkins流水线集成：** ```groovy pipeline { agent any stages { stage('API Security Audit') { steps { script { def auditResult = sh( script: ''' 42crunch-cli audit \ --api-definition openapi.yaml \ --token ${CRUNCH_TOKEN} \ --min-score 75 \ --report-format json \ --output audit-report.json ''', returnStatus: true ) if (auditResult != 0) { error("API安全审计失败 - 分数低于阈值") } } } } stage('Conformance Scan') { when { branch 'main' } steps { sh ''' 42crunch-cli scan \ --api-definition openapi.yaml \ --target-url ${STAGING_URL} \ --token ${CRUNCH_TOKEN} \ --scan-config 42c-conf.yaml ''' } } } post { always { archiveArtifacts artifacts: '*-report.*' publishHTML([ reportDir: '.', reportFiles: 'audit-report.html', reportName: 'API Security Report' ]) } } } ``` ### API Protect（运行时防护） API Protect作为微网关（Micro-Gateway）部署在API端点前端，在运行时强制执行OpenAPI契约： ```yaml # api-protect-config.yaml apiVersion: v1 kind: ConfigMap metadata: name: api-protect-config data: protection-config.json: | { "apiDefinition": "/config/openapi.yaml", "enforcement": { "validateRequests": true, "validateResponses": true, "blockOnFailure": true, "logLevel": "warn" }, "rateLimit": { "enabled": true, "requestsPerMinute": 100, "burstSize": 20 }, "allowlist": { "contentTypes": ["application/json"], "methods": ["GET", "POST", "PUT", "DELETE"] } } ``` ## 修复工作流 当42Crunch发现问题时，遵循以下修复流程： 1. **分类（Triage）**：按严重性（严重、高、中、低）排序查看发现 2. **分析（Analyze）**：理解OpenAPI定义中缺少的特定安全控制 3. **修复（Fix）**：对规范应用推荐的更改 4. **验证（Validate）**：重新运行审计确认分数提升 5. **部署（Deploy）**：通过CI/CD流水线推送更新的规范 **常见审计发现及修复：** | 发现 | 严重性 | 修复方案 | |------|--------|----------| | 未定义认证 | 严重 | 添加securitySchemes和security要求 | | 缺少输入验证 | 高 | 添加type、format、pattern、maxLength约束 | | 服务器URL使用HTTP | 高 | 将服务器URL改为HTTPS | | 未定义错误响应 | 中 | 添加4xx和5xx响应定义 | | additionalProperties未限制 | 中 | 在对象Schema上设置additionalProperties: false | | 缺少速率限制 | 中 | 添加x-rateLimit扩展或使用API Protect | ## 关键安全检查 42Crunch针对以下关键安全领域评估API： - **BOLA防护**：验证是否定义了对象级授权模式 - **BFLA防护**：检查是否定义了功能级访问控制 - **注入防护**：确保输入参数有适当的type/format/pattern约束 - **数据暴露**：验证响应Schema限制返回的属性 - **安全配置错误**：检查认证方案、传输安全、CORS设置 - **批量赋值**：验证请求体使用显式属性白名单 ## 参考资料 - 42Crunch API安全平台: https://42crunch.com/api-security-platform/ - 42Crunch文档: https://docs.42crunch.com/ - Microsoft Defender for Cloud 42Crunch集成: https://learn.microsoft.com/en-us/azure/defender-for-cloud/onboarding-guide-42crunch - OWASP API安全Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x00-header/ - Jenkins 42Crunch插件: https://plugins.jenkins.io/42crunch-security-audit/