Src API Testing

TL;DR

• 目的：API-focused security testing for modern applications: SPA backend APIs, GraphQL, gRPC, WebSocket. Covers discovery, schema enumeration, auth…
• 适用：辅助/通用
• 输入：目标 URL + API 端点列表 + 鉴权方式
• 输出：资产清单/子域/端口表
• 红线：禁止越权访问他人租户；爆破需账号确认门
• 关联：上游：003-src-session-start → 下游：003-src-session-start（按需调用）

Workflow

1. Component fingerprint — Detect technology stack via Wappalyzer, WhatWeb, or headers
2. Endpoint discovery — Crawl JS files, sitemap.xml, robots.txt, OpenAPI/Swagger
3. Schema enumeration — Hit /api/v*/openapi.json or trigger introspection
4. Authentication analysis — Find JWT tokens, OAuth flows, API keys
5. Authorization testing — BOLA/BFLA per endpoint matrix
6. Rate limit testing — Identify thresholds and bypass techniques
7. Mass assignment — Try adding fields not in schema
8. Documentation — Per-endpoint findings with reproduction

Common Tools

• Burp Suite Pro with Autorify, JSON Web Token, Autorize extensions
• Postman / Insomnia — Manual API testing
• curl / httpie — CLI request crafting
• jwt_tool / PyJWT — JWT manipulation
• kiterunner — API endpoint discovery

When to Use

• Target presents indicators of the vulnerability class this skill covers
• Fingerprint or recon indicates the relevant technology stack is in use
• Authorized testing scope covers the target endpoint or component
• Findings need to be validated through this skill's methodology

When NOT to Use

• Target is clearly outside this skill's scope (refer to other web-vulns skills)
• No authorization for testing
• Need reconnaissance rather than exploitation (use 1-recon-osint skills instead)

SRC API Security Testing

Quick Start

# 枚举 API 端点
grep -rn "router\|@app\|@router\|@bp" src/ | head -30
# 查看 API 文档（如有）
curl -s http://target/api/docs | jq .

Objective

Find vulnerabilities in the API layer of scoped modern applications (SPA/mobile backends): broken auth, BOLA, schema abuse, injection, excessive data.

Workflow

1. API Discovery

• From JS bundles: route maps, endpoint lists; from mobile apps (APK decompile if in scope).
• Identify API style: REST / GraphQL / gRPC / WebSocket.
• Note base URLs and auth scheme (JWT, session, key).

2. Schema Enumeration

• OpenAPI/Swagger: /swagger-ui.html, /api-docs, /v2/api-docs, /openapi.json, /swagger/v1/swagger.json.
• GraphQL: introspection query (if enabled) to dump full schema; build query/field map.
• gRPC: reflection (grpcurl -plaintext list).

3. API Auth Testing

• Missing auth on endpoints (public access to protected resources).
• JWT weaknesses: alg confusion (none/HS256 with public key), weak secret, expired token acceptance.
• Token scope/privilege mismatch; IDOR via path/body parameters.

4. Injection & Abuse on API Layer

• GraphQL: injection on arguments, deep nesting (DoS), alias abuse, field duplication (cost attack).
• REST: BOLA (object-level), mass assignment, parameter pollution (HPP).
• WebSocket: auth on upgrade, message injection, IDOR over socket.
• gRPC: field fuzzing, reflection leaks.

5. Evidence

• For each finding: request/response pair, auth context (which token/session), impact.

Red Lines

• No bulk enumeration of other users' data; no DoS (depth/volume limits on GraphQL probes).
• Rate-limit requests (-rl 10).
• Log to /root/dig/audit/oplog.md.

Advanced Techniques

Multi-Session Coordination

Use multiple agent sessions in parallel for different scopes (e.g., one per target subdomain) with shared share/intel/ directory.

Session Persistence

Maintain session state in dig/<agent>/sessions/<target>-<timestamp>/ with notes.md, findings.md, screenshots/ subdirectories.