Test API Security Across 10 Attack Phases

This is a ten-phase, authorized API security assessment workflow spanning REST, GraphQL, WebSocket, JWT, and OAuth 2.0 targets, from discovery through CI/CD integration. Discovery (phase 1) crawls to auto-generate an OpenAPI or GraphQL spec, extracts endpoints from robots.txt and JS files, brute-forces undocumented paths, and runs a three-tier GraphQL introspection attempt - full introspection, a reduced query to evade a WAF, then a minimal __schema probe. Authentication testing (phase 2) covers JWT attacks (alg:none, RS256-to-HS256 key confusion, weak-HMAC key brute-forcing, claim tampering, kid-header injection), OAuth issues (redirect_uri manipulation, missing-state CSRF, Referer token leakage, missing PKCE), and GraphQL auth bypass via GET mutations or batched queries. Authorization testing (phase 3) covers BOLA via numeric ID, UUID, or username/email enumeration plus dual-session replay, and BFLA via privilege escalation, HTTP method switching, API version downgrade, and batch-operation ID injection. GraphQL-specific testing (phase 4) covers introspection leaks, alias- and batch-query DoS, field-repetition and directive-overload DoS, deeply nested recursive queries, field-suggestion information leaks, exposed GraphiQL/Playground, GET-based mutation CSRF, and exposed tracing or debug modes. REST input-validation testing (phase 5) covers method switching, Content-Type tampering, NoSQL injection, SSRF via URL parameters, XXE, parameter pollution, and mass assignment.

Use it only for an authorized assessment with explicit, written permission from the system owner and a defined scope - testing API authentication, authorization, or rate-limiting behavior, or running a full discovery-to-report workflow. Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, the skill requires stating the exact target, confirming written authorization and permitted scope, showing the exact commands and their expected effect, and waiting for explicit confirmation in the conversation - without that confirmation it stays read-only and gives defensive guidance only, preferring a sandbox or disposable VM. Some checks are intrusive, so a non-production mirror is preferred where available, and it must never be run against a system without that explicit authorization.

Later phases add business-logic and differential testing (phase 6: diffing v1 vs v2 API behavior, multi-role permission-matrix checks, coupon/points/price manipulation, and TOCTOU race conditions), WebSocket testing (phase 7: endpoint discovery, message injection, oversized-message handling, type confusion, cross-site WebSocket hijacking), rate-limit and DoS testing (phase 8: header-based bypass via X-Forwarded-For or X-Real-IP, path-variant bypass, Slowloris, nested GraphQL batch DoS, IP-rotation testing), and data-exposure testing (phase 9: comparing API responses against what the UI shows, pagination enumeration, error-message leaks, unauthorized data reached via nested GraphQL traversal, and sensitive endpoints exposed in the OpenAPI spec). Output is reproducible evidence - commands, scripts, screenshots, or a report - plus a completed checklist confirming every workflow step was actually executed rather than just read, that real tool paths were used, and that findings were written back as required.

The workflow names specific tools per phase: Vespasian for traffic-to-OpenAPI/GraphQL spec generation, Entropy for LLM-generated attack scenarios across 5 personas plus a CI watch mode that reruns on spec changes, Escape DAST for business-logic testing with severity-threshold build blocking, api.sh as an 8-phase all-protocol attack pipeline, FireTail for 12 GraphQL-specific tests, jwt_tool for comprehensive JWT testing, and Burp Autorize for dual-session authorization comparison. Phase 10 wires the workflow into CI/CD: automatic reruns on spec changes, DAST-based build blocking by severity, and persisting findings as regression tests.

Security teams and authorized penetration testers running a structured API security assessment against REST, GraphQL, or WebSocket APIs - covering authentication, authorization (BOLA/BFLA), rate limiting, and business logic - who want a repeatable ten-phase workflow instead of an ad hoc list of checks, under a strict authorization gate that keeps the skill read-only until explicit written permission and scope are confirmed.