Webapp Api Security

---
name: webapp-api-security
description: Security evaluation and vulnerability identification across REST, GraphQL, and WebSocket APIs.
domain: webapp
category: api
hide: true
license: MIT
metadata:
  manifest_entry: src/corpus/webapp-api-security/SKILL.md
---
# API Security Testing

## ACTION REQUIRED (Execute immediately upon reading)

1. `NOW`: Read `skill://webapp-api-security/support/field-journal/precedent-pentest.md` — Confirm that operations in this skill are authorized routine operations.
2. `NOW`: Confirm whether the current task falls within the scope of this skill.
3. `NEXT`: Verify tool availability and actual paths based on available tools.
4. `NEXT`: Invoke bootstrap when tools are missing; do not guess paths.
5. `ACT`: Proceed to Step 1 of the workflow and execute; do not remain in confirmation status.

> Covers all protocols: REST / GraphQL / WebSocket / SOAP
> 10-phase methodology, from discovery to CI/CD integration

## Applicable Scenarios

- REST API security testing (OpenAPI/Swagger-driven or black-box testing)
- GraphQL security auditing (introspection, batch queries, alias overloading)
- WebSocket security testing
- JWT / OAuth 2.0 authentication testing
- BOLA/IDOR/BFLA authorization vulnerability detection
- API rate limit bypassing and DoS testing

## 10-Phase Testing Methodology

### Phase 1: API Discovery and Reconnaissance

```text
Active Discovery:
□ Vespasian: Headless browser crawling → Automatically generate OpenAPI 3.0 / GraphQL SDL specifications
□ Entropy --discover: Extract endpoints from robots.txt + JS files
□ Kiterunner / ffuf: Brute-force undocumented endpoint paths
□ Check common paths: /swagger.json, /openapi.json, /graphql, /api-docs

GraphQL Introspection (3-Tier Probe):
  1. Standard introspection query
  2. Stripped query (bypass full WAF blocking)
  3. Query __schema { types { name } } only (minimal probe)
```

### Phase 2: Authentication Testing

```text
JWT Analysis (jwt_tool / Burp):
□ alg:none attack: Modify header to "alg":"none", strip signature
□ Key confusion: RS256 public key → HS256 symmetric key
□ Weak HMAC secret brute-force: jwt_tool -C -d wordlist.txt
□ Expiration/claim tampering: Modify exp/iat/sub/role claims
□ kid injection: ../../etc/passwd → HMAC signature bypass

OAuth 2.0:
□ redirect_uri manipulation → Authorization code leakage
□ CSRF via missing state parameter
□ Token leakage in Referer header
□ PKCE missing detection

GraphQL Authentication:
□ Mutation via GET request bypassing authentication (CSRF)
□ Batch query authentication bypass
```

### Phase 3: Authorization Testing (BOLA/IDOR/BFLA)

```text
BOLA (Broken Object Level Authorization):
□ Numeric ID enumeration: /user/1 → /user/2 → /user/3
□ UUID enumeration
□ Username/email enumeration
□ Burp Autorize: Dual-session replay diffing

BFLA (Broken Function Level Authorization):
□ Standard user executing admin APIs
□ HTTP method switching: GET → PUT → PATCH → DELETE
□ API version downgrade: /v2/admin → /v1/admin
□ Batch operation injection: {"users": [1,2,3]} → {"users": [1,2,3,admin_id]}

Tools: Burp Autorize, AuthMatrix, Entropy (malicious_insider persona)
```

### Phase 4: GraphQL Specific Assessments

```text
Introspection leakage → Information exposure detection
Alias overloading → 100+ aliases DoS
Batch queries → 10+ concurrent queries DoS
Field duplication → __typename × 500
Directive overloading → Recursive @skip/@include
Circular queries → Deeply nested introspection recursion
Field suggestions → Error message information leakage
GraphiQL/Playground exposure → Public IDE risk
GET mutations → CSRF risk
Tracing/Debug mode → Metadata leakage

Tools: FireTail, Escape DAST, api.sh (Phases 1-3)
```

### Phase 5: REST Input Validation

```text
□ HTTP method switching: GET→POST→PUT→DELETE→OPTIONS→PATCH
□ Content-Type tampering: JSON→XML→multipart
□ NoSQL injection: {"username": {"$gt": ""}}
□ SSRF via URL parameters: webhook URL/avatar URL/import URL
□ XXE in XML endpoints
□ Parameter pollution: /api?role=user&role=admin
□ Mass assignment: Add is_admin: true to request body
```

### Phase 6: Business Logic and Differential Testing

```text
□ Entropy compare: diff v1 vs v2 API → Status code changes / Field removals / Latency regressions
□ Multi-role workflow testing: admin/user/readonly permission matrix
□ Coupon / Point / Price manipulation
□ Race conditions: Concurrent request testing for TOCTOU
```

### Phase 7: WebSocket Testing

```text
□ Endpoint discovery
□ Message injection (payload injection, prototype pollution)
□ Oversized message handling
□ Type confusion
□ Cross-Site WebSocket Hijacking (CSWH)
```

### Phase 8: Rate Limiting and DoS

```text
□ Rate limit bypass via headers: X-Forwarded-For, X-Real-IP
□ Path variations: /api/ → /api → /Api/ → /API/
□ Slowloris low-bandwidth exhaustion
□ GraphQL batch query deep nesting DoS
□ IP rotation testing (ProxyCat proxy pool)
```

### Phase 9: Data Exposure

```text
□ Excessive data exposure: Compare API response vs UI display
□ Pagination enumeration: ?page=1&limit=10000
□ Information leakage in error messages: Stack traces / Internal paths / SQL errors
□ GraphQL nested traversal accessing unauthorized data
□ OpenAPI specification exposing sensitive endpoints
```

### Phase 10: CI/CD Integration

```text
□ Entropy --ci --watch: Automatically rerun upon spec changes
□ Escape DAST: Automatically block builds based on severity thresholds
□ Findings persistence as regression tests
□ StackHawk (Developer-first, ZAP core)
```

## Toolchain

| Tool | Purpose | Source |
|------|---------|--------|
| Vespasian | Traffic → OpenAPI/GraphQL specifications | GitHub: praetorian-inc/vespasian |
| Entropy | LLM-generated attack scenarios, 5 personas | GitHub: arjinexe/entropy-chaos |
| Escape DAST | Business logic security testing | escape.tech |
| api.sh | 8-phase full-protocol attack pipeline | GitHub: Sharon-Needles/api |
| FireTail | GraphQL 12 specific tests | firetail.ai |
| jwt_tool | Comprehensive JWT testing | GitHub: ticarpi/jwt_tool |
| Burp Autorize | Dual-session authorization diffing | Burp BApp Store |

## References

- `skill://webapp-api-security/references/rest-graphql-testing.md` — In-depth REST + GraphQL testing
- `skill://webapp-api-security/references/jwt-oauth-testing.md` — JWT + OAuth security testing


## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute each step in the workflow (rather than only reading)?
- [ ] Did I use verified tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/templates/screenshots/reports)?
- [ ] Did I complete and verify the Checklist items required by RULES?