# API Penetration Testing

> Use when testing API security and endpoints.

- Skill: `loopyluci/api-penetration-testing` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/api-penetration-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/api-penetration-testing/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/api-penetration-testing

---


# API Penetration Testing

Testing API security — from REST and GraphQL endpoint testing through authentication bypass, injection, rate limiting, and business logic flaws.

## When to Use

- Testing REST API security
- Testing GraphQL API security
- Finding API authentication and authorization flaws
- Testing API rate limiting and abuse cases
- API-specific vulnerabilities (mass assignment, IDOR)

## API Testing Techniques

```python
API_TESTS = {
    'auth_bypass': 'Test missing/weak JWT, OAuth misconfig, API key in URL, default tokens',
    'injection': 'Test SQL/NoSQL injection in params, headers, request bodies',
    'idor': 'Test object ID manipulation (user/123 → user/124)',
    'mass_assignment': 'Test extra fields in request body (is_admin=true)',
    'rate_limiting': 'Test without auth headers, IP-based limiting bypass (X-Forwarded-For)',
    'graphql_introspection': 'Test if introspection is enabled (query __schema)',
    'graphql_batching': 'Test batch queries for rate limit bypass',
}

# REST API testing with curl
API_TESTS_CURL = {
    'jwt_none_algorithm': "curl -H 'Authorization: Bearer eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.' https://api.example.com/admin",
    'idor_test': "curl https://api.example.com/users/123",
    'mass_assignment': "curl -X PUT https://api.example.com/users/me -d '{\"role\":\"admin\"}'",
}

# GraphQL query depth testing
GRAPHQL_DEPTH = """
query DeepQuery {
  user(id: 1) {
    posts { comments { author { posts { comments { author { name } } } } } }
  }
}
"""
```

## Verification Checklist

- [ ] Authentication tested (JWT none algo, token in URL, missing auth)
- [ ] Authorization tested (IDOR, horizontal/vertical privilege esc)
- [ ] Injection tested (SQL, NoSQL, command injection in params)
- [ ] Rate limiting tested (brute force, resource exhaustion)
- [ ] Mass assignment tested (extra fields in request)
- [ ] GraphQL: introspection, query depth, batching attacks
- [ ] Input validation tested (XSS, SSRF, XXE)
- [ ] API versioning and deprecation tested
- [ ] CORS configuration reviewed