vapt-api

API Security Testing

When Invoked

The user runs /vapt api <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Prerequisites

Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered API endpoints
• If VAPT-SCAN.md exists -> extract API paths from scan results
• If no context -> discover API endpoints via common paths

Phase 1: API Discovery

1.1 OpenAPI / Swagger Detection

# Common OpenAPI spec locations
for path in /swagger.json /swagger-ui /openapi.json /api-docs /api/v1/swagger.json /api/docs /v1/api-docs /v2/api-docs /api/swagger /docs/api; do
    code=$(curl -s -o /dev/null -w "%{http_code}" <url>$path)
    [ "$code" != "404" ] && echo "Found: $path ($code)"
done

If a spec file is found, parse it to extract all endpoints, methods, and parameters.

1.2 GraphQL Detection

# Common GraphQL endpoints
for path in /graphql /graphiql /v1/graphql /api/graphql /query; do
    code=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d '{"query":"{__typename}"}' <url>$path)
    [ "$code" = "200" ] && echo "GraphQL found: $path"
done

1.3 API Endpoint Fuzzing

If kiterunner is installed:

kr scan <url> -w /path/to/routes-large.kite

If ffuf is installed:

ffuf -u <url>/api/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,201,401,403

Fallback: Check common API path patterns:

/api, /api/v1, /api/v2, /api/v3
/api/users, /api/admin, /api/config
/api/health, /api/status, /api/metrics
/api/search, /api/export, /api/import

Phase 2: Authentication Testing

2.1 Unauthenticated Access

Test all discovered endpoints without authentication:

for endpoint in <discovered_endpoints>; do
    echo "$endpoint: $(curl -s -o /dev/null -w '%{http_code}' <url>$endpoint)"
done

Endpoints that return 200 without auth may be misconfigured.

2.2 API Key / Token Analysis

If API keys are used:

• Check if keys are in URLs (leakable via logs/referrer)
• Check key rotation / expiration
• Test with expired or revoked keys
• Check rate limiting per key