api-breaker

Name: api-breaker
Author: Orizon-eu

18stars4forks

How to install api-breaker?

orizon-eu/claude-code-pentest/api-breaker

$npx -y skills add Orizon-eu/claude-code-pentest --skill api-breaker

Installs into the current project.

Summary

Automated API security testing starting from domains. Discovers REST, GraphQL, and SOAP APIs, reconstructs schemas, and tests for BOLA/IDOR, BFLA, mass assignment, JWT attacks, rate limiting bypass, and business logic flaws. Use when user asks to "test API security", "break API",

Files · 1

View on GitHub

SKILL.md

1	# API Breaker
2
3	Intelligent API security testing. Discovers, maps, and exploits API vulnerabilities.
4
5	## Important
6
7	CRITICAL: Only test APIs you have explicit authorization to test.
8
9	## Instructions
10
11	### Step 1: API Discovery
12
13	```bash
14	python scripts/api_discovery.py --domain {target_domain}
15	```
16
17	Discovery methods:
18	1. Path fuzzing: /api/, /v1/, /v2/, /graphql, /rest/, /swagger.json, /openapi.json, /api-docs
19	2. JavaScript analysis: Parse JS files for hardcoded API endpoints, base URLs, fetch/axios calls
20	3. Wayback Machine: Historical API endpoints that may still be active
21	4. Common patterns: /{resource}s, /{resource}/{id}, /{resource}/{id}/{subresource}
22	5. GraphQL detection: /graphql, /graphiql, /playground, /api/graphql
23	6. Documentation endpoints: Swagger, OpenAPI, WADL, WSDL
24
25	For each discovered API:
26	- Record base URL, authentication method, content type
27	- Detect API standard (REST, GraphQL, gRPC-web, SOAP)
28
29	### Step 2: Schema Reconstruction
30
31	```bash
32	python scripts/schema_builder.py --api-base {api_url}
33	```
34
35	Even without documentation:
36	1. Send requests with varying parameters and observe responses
37	2. Analyze error messages for expected field names/types
38	3. Use OPTIONS/HEAD to discover allowed methods
39	4. Test content negotiation (JSON, XML, form-encoded)
40	5. GraphQL: Send introspection query to get full schema
41
42	Output: Reconstructed API schema in OpenAPI format.
43
44	### Step 3: Authentication Analysis
45
46	```bash
47	python scripts/auth_analyzer.py --api-base {api_url}
48	```
49
50	Detect and test:
51	- JWT tokens: Decode, test none algorithm, key confusion (RS256->HS256), weak secrets, claim tampering
52	- API keys: Test in different positions (header, query, body), check for key leakage
53	- OAuth flows: Test for open redirect in callback, token leakage, PKCE bypass
54	- Session tokens: Predictability, fixation, rotation on privilege change
55	- No auth: Endpoints accessible without any authentication
56
57	### Step 4: Authorization Testing (BOLA/BFLA)
58
59	```bash
60	python scripts/authz_tester.py --schema {schema_file} --token {user_token}
61	```
62
63	BOLA (Broken Object-Level Authorization):
64	For every endpoint with an object ID:
65	1. Create resource as User A, note the ID
66	2. Access that ID as User B (different token)
67	3. If User B can read/modify/delete User A's resource = BOLA
68
69	BFLA (Broken Function-Level Authorization):
70	1. Map endpoints by intended role (user vs admin)
71	2. Test admin endpoints with regular user token
72	3. Test all HTTP methods (GET, POST, PUT, DELETE, PATCH) on each endpoint
73
74	### Step 5: Mass Assignment Testing
75
76	```bash
77	python scripts/mass_assignment.py --schema {schema_file} --token {token}
78	```
79
80	For each creation/update endpoint:
81	1. Send normal request, note accepted fields
82	2. Add extra fields: `role`, `isAdmin`, `price`, `discount`, `verified`, `approved`, `permissions`
83	3. Check if extra fields are processed
84	4. Test with nested objects: `{"user": {"role": "admin"}}`
85
86	### Step 6: Rate Limiting and Resource Testing
87
88	```bash
89	python scripts/rate_limiter.py --api-base {api_url}
90	```
91
92	Test:
93	- Send 100+ rapid requests to each endpoint
94	- Check for 429 responses or rate limit headers
95	- If rate limited: test bypass via IP rotation headers (X-Forwarded-For, X-Real-IP)
96	- Test resource-intensive endpoints for DoS potential (large pagination, deep queries)
97	- GraphQL: Test query batching, nested query depth, alias-based multiplication
98
99	### Step 7: Business Logic Testing
100
101	```bash
102	python scripts/logic_tester.py --schema {schema_file} --token {token}
103	```
104
105	Context-aware tests:
106	- E-commerce: Price manipulation, quantity overflow, currency confusion, coupon stacking
107	- Financial: Double spending via race conditions, negative amount transfer
108	- User management: Self-privilege escalation, email verification bypass, 2FA bypass
109	- File handling: Path traversal in file names, SSRF in URL fields, XXE in XML endpoints
110
111	### Step 8: Report Generation
112
113	```bash
114	python scripts/api_report.py --findings {findings_dir}
115	```
116
117	Per-finding output:
118	- Vulnerability type and OWASP API Security Top 10 mapping
119	- Affected endpoint and method
120	- Request/response showing the issue
121	- curl command for reproduction
122	- Impact assessment
123	- Remediation recommendation
124
125	## Error Handling
126
127	### No API Documentation Found
128	If no Swagger/OpenAPI exists:
129	1. Schema reconstruction from observed behavior (Step 2)
130	2. Use error messages as hints for field discovery
131	3. Inform user of reduced coverage without docs
132
133	### Authentication Required
134	1. Ask

People who liked this also viewed

6 picks

Type

api-breaker

18stars4forks

View on GitHub

How to install api-breaker?

orizon-eu/claude-code-pentest/api-breaker

$npx -y skills add Orizon-eu/claude-code-pentest --skill api-breaker

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Breaker
2
3	Intelligent API security testing. Discovers, maps, and exploits API vulnerabilities.
4
5	## Important
6
7	CRITICAL: Only test APIs you have explicit authorization to test.
8
9	## Instructions
10
11	### Step 1: API Discovery
12
13	```bash
14	python scripts/api_discovery.py --domain {target_domain}
15	```
16
17	Discovery methods:
18	1. Path fuzzing: /api/, /v1/, /v2/, /graphql, /rest/, /swagger.json, /openapi.json, /api-docs
19	2. JavaScript analysis: Parse JS files for hardcoded API endpoints, base URLs, fetch/axios calls
20	3. Wayback Machine: Historical API endpoints that may still be active
21	4. Common patterns: /{resource}s, /{resource}/{id}, /{resource}/{id}/{subresource}
22	5. GraphQL detection: /graphql, /graphiql, /playground, /api/graphql
23	6. Documentation endpoints: Swagger, OpenAPI, WADL, WSDL
24
25	For each discovered API:
26	- Record base URL, authentication method, content type
27	- Detect API standard (REST, GraphQL, gRPC-web, SOAP)
28
29	### Step 2: Schema Reconstruction
30
31	```bash
32	python scripts/schema_builder.py --api-base {api_url}
33	```
34
35	Even without documentation:
36	1. Send requests with varying parameters and observe responses
37	2. Analyze error messages for expected field names/types
38	3. Use OPTIONS/HEAD to discover allowed methods
39	4. Test content negotiation (JSON, XML, form-encoded)
40	5. GraphQL: Send introspection query to get full schema
41
42	Output: Reconstructed API schema in OpenAPI format.
43
44	### Step 3: Authentication Analysis
45
46	```bash
47	python scripts/auth_analyzer.py --api-base {api_url}
48	```
49
50	Detect and test:
51	- JWT tokens: Decode, test none algorithm, key confusion (RS256->HS256), weak secrets, claim tampering
52	- API keys: Test in different positions (header, query, body), check for key leakage
53	- OAuth flows: Test for open redirect in callback, token leakage, PKCE bypass
54	- Session tokens: Predictability, fixation, rotation on privilege change
55	- No auth: Endpoints accessible without any authentication
56
57	### Step 4: Authorization Testing (BOLA/BFLA)
58
59	```bash
60	python scripts/authz_tester.py --schema {schema_file} --token {user_token}
61	```
62
63	BOLA (Broken Object-Level Authorization):
64	For every endpoint with an object ID:
65	1. Create resource as User A, note the ID
66	2. Access that ID as User B (different token)
67	3. If User B can read/modify/delete User A's resource = BOLA
68
69	BFLA (Broken Function-Level Authorization):
70	1. Map endpoints by intended role (user vs admin)
71	2. Test admin endpoints with regular user token
72	3. Test all HTTP methods (GET, POST, PUT, DELETE, PATCH) on each endpoint
73
74	### Step 5: Mass Assignment Testing
75
76	```bash
77	python scripts/mass_assignment.py --schema {schema_file} --token {token}
78	```
79
80	For each creation/update endpoint:
81	1. Send normal request, note accepted fields
82	2. Add extra fields: `role`, `isAdmin`, `price`, `discount`, `verified`, `approved`, `permissions`
83	3. Check if extra fields are processed
84	4. Test with nested objects: `{"user": {"role": "admin"}}`
85
86	### Step 6: Rate Limiting and Resource Testing
87
88	```bash
89	python scripts/rate_limiter.py --api-base {api_url}
90	```
91
92	Test:
93	- Send 100+ rapid requests to each endpoint
94	- Check for 429 responses or rate limit headers
95	- If rate limited: test bypass via IP rotation headers (X-Forwarded-For, X-Real-IP)
96	- Test resource-intensive endpoints for DoS potential (large pagination, deep queries)
97	- GraphQL: Test query batching, nested query depth, alias-based multiplication
98
99	### Step 7: Business Logic Testing
100
101	```bash
102	python scripts/logic_tester.py --schema {schema_file} --token {token}
103	```
104
105	Context-aware tests:
106	- E-commerce: Price manipulation, quantity overflow, currency confusion, coupon stacking
107	- Financial: Double spending via race conditions, negative amount transfer
108	- User management: Self-privilege escalation, email verification bypass, 2FA bypass
109	- File handling: Path traversal in file names, SSRF in URL fields, XXE in XML endpoints
110
111	### Step 8: Report Generation
112
113	```bash
114	python scripts/api_report.py --findings {findings_dir}
115	```
116
117	Per-finding output:
118	- Vulnerability type and OWASP API Security Top 10 mapping
119	- Affected endpoint and method
120	- Request/response showing the issue
121	- curl command for reproduction
122	- Impact assessment
123	- Remediation recommendation
124
125	## Error Handling
126
127	### No API Documentation Found
128	If no Swagger/OpenAPI exists:
129	1. Schema reconstruction from observed behavior (Step 2)
130	2. Use error messages as hints for field discovery
131	3. Inform user of reduced coverage without docs
132
133	### Authentication Required
134	1. Ask

People who liked this also viewed

6 picks

Type