Api Auth Attacks

Name: Api Auth Attacks
Author: NoorQureshi

ASecurity

Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.

20 stars

0 votes

0 copies

0 views

Added 9/22/2026

securitygocode-reviewgitapisecurity

Works with

cliapi

Security Analysis

A100/100

Scanned 9/22/2026

$npx -y skills add NoorQureshi/SploitAgent --skill api-auth-attacks --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Api Auth Attacks?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Api Auth Attacks

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/noorqureshi-api-auth-attacks/badge)](https://www.skillsdirectory.com/skills/noorqureshi-api-auth-attacks)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

Files

SKILL.md

---
name: api-auth-attacks
description: >
  Break API authentication: token handling, key leakage, weak session/JWT, and no-auth
  endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic
  auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.
domain: api
type: technique
stability: learning
modes: [bugbounty]
severity: high
owasp_api: [API2:2023-Broken-Authentication]
cwe: [CWE-287, CWE-306]
tools: [burp, jwt_tool]
schema_version: 1
---

# API authentication attacks

## When it applies
An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open
everything behind it.

## Why it works
APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently:
some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and
error/timing differences enable enumeration and brute force.

## Method
1. **No-auth endpoints**: replay requests with the token removed; probe `/v1` vs `/v2`,
   `/internal`, `/debug`, and undocumented routes (Swagger/OpenAPI) for missing auth.
2. **Token weaknesses**: JWT issues (→ `web-auth-jwt`: alg confusion, weak secret, none); long/
   non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked).
3. **Key leakage**: hunt keys in JS bundles, mobile apps, git (→ `code-review-secrets-detection`),
   and test their privilege/scope.
4. **Brute/enumeration**: username enumeration via login/reset differences; weak rate limits on
   login/OTP (→ `web-race-conditions` for OTP windows).
5. **Auth logic**: password reset token predictability/leak, 2FA bypass, "remember me" tokens.

## Gotchas
- Test every version and verb — the fix may exist only on the newest route.
- A leaked key must be *live and privileged* to matter — validate scope, don't over-collect.
- Rate-limit "bypass" via parallelism or header rotation is reportable on many programs.

## Verify success
Authenticated access without valid credentials (no-auth route, forged/replayed token, or a live
leaked key performing a privileged action).

## References
OWASP API Security Top 10 (API2); PortSwigger auth labs.

Attribution

NoorQureshi

View source See grades on GitHub More from NoorQureshi →

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

--- name: api-auth-attacks description: > Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift. domain: api type: technique stability: learning modes: [bugbounty] severity: high owasp_api: [API2:2023-Broken-Authentication] cwe: [CWE-287, CWE-306] tools: [burp, jwt_tool] schema_version: 1 --- # API authentication attacks ## When it applies An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open everything behind it. ## Why it works APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently: some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and error/timing differences enable enumeration and brute force. ## Method 1. **No-auth endpoints**: replay requests with the token removed; probe `/v1` vs `/v2`, `/internal`, `/debug`, and undocumented routes (Swagger/OpenAPI) for missing auth. 2. **Token weaknesses**: JWT issues (→ `web-auth-jwt`: alg confusion, weak secret, none); long/ non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked). 3. **Key leakage**: hunt keys in JS bundles, mobile apps, git (→ `code-review-secrets-detection`), and test their privilege/scope. 4. **Brute/enumeration**: username enumeration via login/reset differences; weak rate limits on login/OTP (→ `web-race-conditions` for OTP windows). 5. **Auth logic**: password reset token predictability/leak, 2FA bypass, "remember me" tokens. ## Gotchas - Test every version and verb — the fix may exist only on the newest route. - A leaked key must be *live and privileged* to matter — validate scope, don't over-collect. - Rate-limit "bypass" via parallelism or header rotation is reportable on many programs. ## Verify success Authenticated access without valid credentials (no-auth route, forged/replayed token, or a live leaked key performing a privileged action). ## References OWASP API Security Top 10 (API2); PortSwigger auth labs.