pentest-api-deep

---
name: pentest-api-deep
description: Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.
license: Apache-2.0
---

# Pentest API Deep

## Purpose
Perform dedicated API-specific vulnerability testing beyond basic BOLA/GraphQL coverage. Addresses Broken Function Level Authorization (BFLA), mass assignment, rate limiting, excessive data exposure, and unsafe consumption per OWASP API Security Top 10 (2023).

## Prerequisites

### Authorization Requirements
- **Written authorization** with API testing scope explicitly included
- **API documentation** (OpenAPI/Swagger specs, GraphQL schema) if available
- **Test accounts** at multiple privilege levels (user, admin, service account)
- **Rate limit awareness** — confirm acceptable request volume with target owner

### Environment Setup
- Postman or Insomnia for manual API exploration
- Burp Suite with API-specific extensions
- GraphQL Voyager for schema visualization
- grpcurl for gRPC service testing

## Core Workflow
1. **API Discovery**: Enumerate endpoints via OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, traffic analysis. Discover undocumented endpoints with Kiterunner.
2. **BFLA Testing**: Access admin-only API functions as regular user. HTTP method switching (GET→DELETE). Test function-level authorization gaps distinct from object-level (BOLA).
3. **Mass Assignment**: Send extra fields in POST/PUT (role, isAdmin, balance). Check response objects for leaked internal fields (WSTG-INPV-20).
4. **Rate Limiting & Resource**: Test missing rate limits, GraphQL depth/complexity abuse, pagination abuse, regex DoS via API input.
5. **Excessive Data Exposure**: Compare API responses across privilege levels. Identify fields returned but not displayed in UI. Test verbose error responses.
6. **Unsafe Consumption**: SSRF through upstream API calls, injection through trusted-but-tainted API response data.
7. **API Versioning**: Old API versions with weaker controls, version header manipulation, deprecated endpoint access.

## OWASP API Security Top 10 (2023) Coverage

| Category | Test Focus | Status |
|----------|-----------|--------|
| API1 Broken Object Level Authorization | IDOR via API params | ✅ |
| API2 Broken Authentication | Token/key weaknesses | ✅ |
| API3 Broken Object Property Level Authorization | Mass assignment, excessive data | ✅ |
| API4 Unrestricted Resource Consumption | Rate limits, complexity | ✅ |
| API5 Broken Function Level Authorization | BFLA, method switching | ✅ |
| API6 Unrestricted Access to Sensitive Business Flows | Automation abuse | ✅ |
| API7 Server Side Request Forgery | API-triggered SSRF | ✅ |
| API8 Security Misconfiguration | CORS, headers, versioning | ✅ |
| API9 Improper Inventory Management | Shadow APIs, deprecated versions | ✅ |
| API10 Unsafe Consumption of Third-Party APIs | Upstream injection | ✅ |

## Tool Categories

| Category | Tools | Purpose |
|----------|-------|---------|
| API Discovery | Kiterunner, Swagger UI, GraphQL Voyager | Endpoint enumeration |
| Parameter Discovery | Arjun, x8, ParamSpider | Hidden parameter detection |
| Fuzzing | ffuf, Burp Intruder, custom scripts | Mass assignment, BFLA |
| GraphQL | graphql-cop, InQL, BatchQL | GraphQL-specific attacks |
| gRPC | grpcurl, grpc-tools | gRPC reflection and testing |
| Rate Testing | custom aiohttp scripts, Turbo Intruder | Rate limit verification |

## References
- `references/tools.md` - Tool function signatures and parameters
- `references/workflows.md` - Attack pattern definitions and test vectors