api-breaker

API Breaker

Intelligent API security testing. Discovers, maps, and exploits API vulnerabilities.

Important

CRITICAL: Only test APIs you have explicit authorization to test.

Instructions

Step 1: API Discovery

python scripts/api_discovery.py --domain {target_domain}

Discovery methods:

1. Path fuzzing: /api/, /v1/, /v2/, /graphql, /rest/, /swagger.json, /openapi.json, /api-docs
2. JavaScript analysis: Parse JS files for hardcoded API endpoints, base URLs, fetch/axios calls
3. Wayback Machine: Historical API endpoints that may still be active
4. Common patterns: /{resource}s, /{resource}/{id}, /{resource}/{id}/{subresource}
5. GraphQL detection: /graphql, /graphiql, /playground, /api/graphql
6. Documentation endpoints: Swagger, OpenAPI, WADL, WSDL

For each discovered API:

• Record base URL, authentication method, content type
• Detect API standard (REST, GraphQL, gRPC-web, SOAP)

Step 2: Schema Reconstruction

python scripts/schema_builder.py --api-base {api_url}

Even without documentation:

1. Send requests with varying parameters and observe responses
2. Analyze error messages for expected field names/types
3. Use OPTIONS/HEAD to discover allowed methods
4. Test content negotiation (JSON, XML, form-encoded)
5. GraphQL: Send introspection query to get full schema

Output: Reconstructed API schema in OpenAPI format.

Step 3: Authentication Analysis

python scripts/auth_analyzer.py --api-base {api_url}

Detect and test:

• JWT tokens: Decode, test none algorithm, key confusion (RS256->HS256), weak secrets, claim tampering
• API keys: Test in different positions (header, query, body), check for key leakage
• OAuth flows: Test for open redirect in callback, token leakage, PKCE bypass
• Session tokens: Predictability, fixation, rotation on privilege change
• No auth: Endpoints accessible without any authentication

Step 4: Authorization Testing (BOLA/BFLA)

python scripts/authz_tester.py --schema {schema_file} --token {user_token}