/test-web-and-api-security

name: test-web-and-api-security
description: Test an authorized web application or API using OWASP guidance. Use for authentication, authorization, sessions, input, schemas, business logic, file handling, server-side requests, configuration, transport, errors, and data exposure.

Test Web And API Security

Overview

Test one scoped property at a time with role-aware accounts and reproducible requests. Use passive observation before active mutation and review automated scanner behavior before it reaches the target.

Read [references/web-api-test-plan.md](references/web-api-test-plan.md) and current OWASP WSTG/API guidance before execution.

Workflow

1. Load the approved scope, environment, accounts/roles, data, rate limits, and stop conditions. 2. Map the application.

• Record hosts, routes, APIs/schemas, roles, trust boundaries, sessions/tokens, browser controls, uploads, integrations, and state-changing operations.

3. Capture a baseline.

• Preserve normal requests/responses and expected authorization for each role and resource owner.

4. Test by security property.

• Cover identity/session, object/function authorization, input handling, browser/client boundaries, server-side fetches, files, configuration, errors, data exposure, business logic, and rate/resource controls as scope permits.

5. Use tools deliberately.

• Keep proxy/browser history scoped; review ZAP or Nuclei configuration/templates; exclude destructive or broad checks; record exact versions and requests.

6. Validate candidates.

• Reproduce with the smallest request, negative control, different role/owner, and fixed/mitigated state when available.

7. Clean up.

• Remove test data/accounts/tokens, restore state, and report anything that could not be reverted.

Output

Return scope/accounts, application map, tests and evidence, validated findings, negative results/coverage gaps, cleanup, and retest criteria.