/apiscan

description: API security audit — REST, GraphQL, JWT analysis, parameter discovery
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <api-base-url>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

API Security Audit

Target: `$ARGUMENTS`

Execute a comprehensive API security audit using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `comprehensive_api_audit` — full API security audit
• `api_fuzzer` — endpoint and parameter fuzzing
• `jwt_analyzer` — JWT token analysis and attack testing
• `graphql_scanner` — GraphQL introspection and injection testing
• `arjun_parameter_discovery` — hidden parameter discovery
• `api_schema_analyzer` — OpenAPI/Swagger schema analysis

Step 2: Schema Discovery

Check for common API documentation endpoints:

• `/swagger.json`, `/openapi.json`, `/api-docs`
• `/graphql` with introspection query
• Run `api_schema_analyzer` if a schema is found

Step 3: Comprehensive Audit

Run `comprehensive_api_audit` against the API base URL. This performs broad coverage testing including auth, injection, access control, and business logic.

Step 4: JWT Analysis

If JWT tokens are in scope, run `jwt_analyzer` to:

• Decode and inspect token claims
• Test algorithm confusion (alg:none, RS256→HS256)
• Check signature validation
• Test expiration enforcement
• Attempt key brute-forcing for HS256

Step 5: Parameter Discovery

Run `arjun_parameter_discovery` on key endpoints to find hidden/undocumented parameters that may bypass access controls or enable injection.

Step 6: Fuzzing

Run `api_fuzzer` on discovered endpoints with:

• Method fuzzing (GET/POST/PUT/DELETE/PATCH)
• Content-type confusion (JSON vs urlencoded vs XML)
• Parameter type confusion (string vs int vs bool vs array)
• Auth bypass headers (X-Forwarded-For, X-Original-URL)

Step 7: GraphQL (if applicable)

Run `graphql_scanner` for:

• Introspection enumeration
• Injection testing on fields
• Depth/complexity abuse
• Batch query attacks

Step 8: Results

Save findings to `apiscan-{target}.md` in the project directory, organized by:

• Authentication/Authorization issues
• Injection vulnerabilities
• IDOR / Access control failures
• Information disclosure
• Business logic flaws