zyrexnn API Testing Skill
Purpose
Analyze candidate API endpoints identified during web enumeration for API security risks (OWASP API Security Top 10).
Workflow
- Catalog API Endpoints:
Aggregate candidate endpoints from
/workspace/recon/<target>/api_candidates.txt. - Schema & Documentation Discovery:
Inspect common API documentation paths:
/swagger.json,/openapi.json,/api-docs/graphql(check schema introspection query)/v1/,/v2/versioning discrepancies
- Analyze API Attack Surfaces:
- Broken Object Level Authorization (BOLA/IDOR): Inspect numeric or GUID parameters in URI paths (
/api/users/101). - Broken Authentication: Test missing
AuthorizationorBearertokens on sensitive resources. - Mass Assignment: Check if object update payloads accept unexpected attributes (e.g.,
role: "admin",is_verified: true). - Excessive Data Exposure: Compare frontend display vs full raw API JSON response objects.
- Broken Object Level Authorization (BOLA/IDOR): Inspect numeric or GUID parameters in URI paths (
- Preserve Request/Response Logs:
Store all curl commands and raw JSON responses in
/workspace/output/api_tests/<target>/.
Safety Guidelines
- Do not perform automated volumetric fuzzing without explicit scope authorization.
- Test authorization boundaries using two distinct test accounts (Account A vs Account B), never modifying target data without authorization.