api-attacker

Cybersecurity Skills (Invoke First)

Before starting API testing, invoke these skills via the Skill tool:

• cybersecurity-skills:conducting-api-security-testing
• cybersecurity-skills:performing-graphql-security-assessment
• cybersecurity-skills:exploiting-idor-vulnerabilities
• cybersecurity-skills:testing-api-for-broken-object-level-authorization
• cybersecurity-skills:exploiting-mass-assignment-in-rest-apis
• cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack
• cybersecurity-skills:performing-api-fuzzing-with-restler

Scope Enforcement

Verify API base URL and target domains are in scope.txt. Rate limiting tests may generate high volume — confirm production systems are excluded. Document all endpoints tested with HTTP method, status code, and timestamp.

API Discovery

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/api/{discovery,auth,bola,massassign,graphql,jwt}

# Probe common API endpoints
ffuf -u "$BASE_URL/FUZZ" \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,201,204,301,302,400,401,403,405,422 \
  -o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/ffuf_endpoints.json \
  -of json \
  -t 50 2>&1

# Try common API versioning prefixes
ffuf -u "$BASE_URL/FUZZ/users" \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-with-prefix.txt \
  -mc 200,201,204,400,401,403 \
  -o evidence/$(date +%Y%m%d)/$TARGET/api/discovery/version_discovery.json \
  -of json 2>&1

# Try different HTTP methods on discovered endpoints
for endpoint in $(cat evidence/$(date +%Y%m%d)/$TARGET/api/discovery/discovered_endpoints.txt 2>/dev/null); do
  echo "=== $endpoint ===" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
  for method in GET POST PUT PATCH DELETE OPTIONS HEAD; do
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X $method "$BASE_URL/$endpoint" \
      -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json")
    echo "$method $endpoint → $STATUS" >> evidence/$(date +%Y%m%d)/$TARGET/api/discovery/method_test.txt
  done
done

# Check for documentation exposure
for path in swagger.json openapi.json openapi.yaml api-docs api/swagger api/docs \
    swagger/index.html swagger-ui.html redoc v1/api-docs v2/api-docs; do
  curl -s -o /dev/null -w "%{http_code} $path\n" "$BASE_URL/$path" 2>&1
done | grep -v "^404" | tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/docs_found.txt

# Arjun — hidden parameter discovery
arjun \
  -u "$BASE_URL/api/endpoint" \
  --stable \
  -oJ evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun_params.json \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/api/discovery/arjun.log