# Src API Testing

> Perform src api testing assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/src-api-testing` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add wufufu770/src-api-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/src-api-testing/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/src-api-testing

---


## TL;DR

- **目的**：API-focused security testing for modern applications: SPA backend APIs, GraphQL, gRPC, WebSocket. Covers discovery, schema enumeration, auth…
- **适用**：辅助/通用
- **输入**：目标 URL + API 端点列表 + 鉴权方式
- **输出**：资产清单/子域/端口表
- **红线**：禁止越权访问他人租户；爆破需账号确认门
- **关联**：上游：003-src-session-start → 下游：003-src-session-start（按需调用）



## Workflow

1. **Component fingerprint** — Detect technology stack via Wappalyzer, WhatWeb, or headers
2. **Endpoint discovery** — Crawl JS files, sitemap.xml, robots.txt, OpenAPI/Swagger
3. **Schema enumeration** — Hit `/api/v*/openapi.json` or trigger introspection
4. **Authentication analysis** — Find JWT tokens, OAuth flows, API keys
5. **Authorization testing** — BOLA/BFLA per endpoint matrix
6. **Rate limit testing** — Identify thresholds and bypass techniques
7. **Mass assignment** — Try adding fields not in schema
8. **Documentation** — Per-endpoint findings with reproduction

## Common Tools

- **Burp Suite Pro** with Autorify, JSON Web Token, Autorize extensions
- **Postman / Insomnia** — Manual API testing
- **curl / httpie** — CLI request crafting
- **jwt_tool / PyJWT** — JWT manipulation
- **kiterunner** — API endpoint discovery

## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology

## When NOT to Use

- Target is clearly outside this skill's scope (refer to other web-vulns skills)
- No authorization for testing
- Need reconnaissance rather than exploitation (use 1-recon-osint skills instead)

# SRC API Security Testing

## Quick Start

```bash
# 枚举 API 端点
grep -rn "router\|@app\|@router\|@bp" src/ | head -30
# 查看 API 文档（如有）
curl -s http://target/api/docs | jq .
```

## Objective
Find vulnerabilities in the API layer of scoped modern applications (SPA/mobile backends): broken auth, BOLA, schema abuse, injection, excessive data.

## Workflow

### 1. API Discovery
- From JS bundles: route maps, endpoint lists; from mobile apps (APK decompile if in scope).
- Identify API style: REST / GraphQL / gRPC / WebSocket.
- Note base URLs and auth scheme (JWT, session, key).

### 2. Schema Enumeration
- OpenAPI/Swagger: /swagger-ui.html, /api-docs, /v2/api-docs, /openapi.json, /swagger/v1/swagger.json.
- GraphQL: introspection query (if enabled) to dump full schema; build query/field map.
- gRPC: reflection (grpcurl -plaintext list).

### 3. API Auth Testing
- Missing auth on endpoints (public access to protected resources).
- JWT weaknesses: alg confusion (none/HS256 with public key), weak secret, expired token acceptance.
- Token scope/privilege mismatch; IDOR via path/body parameters.

### 4. Injection & Abuse on API Layer
- GraphQL: injection on arguments, deep nesting (DoS), alias abuse, field duplication (cost attack).
- REST: BOLA (object-level), mass assignment, parameter pollution (HPP).
- WebSocket: auth on upgrade, message injection, IDOR over socket.
- gRPC: field fuzzing, reflection leaks.

### 5. Evidence
- For each finding: request/response pair, auth context (which token/session), impact.

## Red Lines
- No bulk enumeration of other users' data; no DoS (depth/volume limits on GraphQL probes).
- Rate-limit requests (-rl 10).
- Log to /root/dig/audit/oplog.md.


## Advanced Techniques

### Multi-Session Coordination
Use multiple agent sessions in parallel for different scopes (e.g., one per target subdomain) with shared `share/intel/` directory.

### Session Persistence
Maintain session state in `dig/<agent>/sessions/<target>-<timestamp>/` with notes.md, findings.md, screenshots/ subdirectories.