api-security

13

williamzujkowski

1. Broken Object Level Authorization (BOLA) - API fails to validate user access to objects 2. Broken Authentication - Weak or missing authentication mechanisms 3. Broken Object Property Level Authorization - Missing field-level access control 4. Unrestricted Resource Consumption - No rate limiting or throttling 5. Broken Function Level Authorization - Missing authorization checks on endpoints 6. Unrestricted Access to Sensitive Business Flows - Automated abuse of legitimate workflows 7. Server Side Request Forgery (SSRF) - API accepts URLs without validation 8. Security Misconfiguration - Insecure default configs, verbose errors 9. Improper Inventory Management - Undocumented/deprecated APIs in production 10. Unsafe Consumption of APIs - Trusting third-party API data without validation

testing-api-for-broken-object-level-authorization

2

mukul975

Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically replaces them with IDs belonging to other users to determine if the server enforces per-object authorization. This is OWASP API Security Top 10 2023 risk API1. Activates for requests involving BOLA testing, IDOR in APIs, object-level authorization testing, or API access control bypass.

detecting-api-enumeration-attacks

2

mukul975

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

API Pentest

Poatan222

Targeted API penetration testing using a GTFO-first approach: find the highest-impact vulnerability fast, prove it with a PoC, and move on. Covers five attack families: AuthN/AuthZ, BOLA/IDOR, Input Validation, SSRF, and Business Logic. Each family is a loadable module with specific test cases, payloads, and PoC templates. Trigger when user mentions "API pentest", "API security test", "test this API", "find vulnerabilities in this endpoint", "BOLA", "IDOR", "broken auth", "injection test", "SSRF", "business logic flaw", "API attack", or shares API docs, Swagger/OpenAPI specs, Postman collections, or curl commands.

API Pentesting

narlyseorg

Use when testing APIs for security vulnerabilities, assessing REST/GraphQL/gRPC/WebSocket/SOAP endpoints, testing API authentication and authorization (OAuth2, JWT, API keys), discovering undocumented API endpoints, testing for BOLA/IDOR in API resources, performing API fuzzing, analyzing API traffic, testing rate limiting, or when the target exposes programmatic interfaces requiring security assessment per OWASP API Security Top 10.