Skill282 estrellas del repoactualizado yesterday

pentest-api-deep

This skill performs comprehensive vulnerability testing on REST, GraphQL, gRPC, and WebSocket APIs against the OWASP API Security Top 10 (2023), focusing on broken function-level authorization, mass assignment vulnerabilities, rate limiting gaps, and unsafe data consumption. Use it when conducting authorized security assessments of API infrastructure where object-level access control alone is insufficient and additional privilege escalation, property tampering, and resource exhaustion vectors require dedicated testing.

Ver fuente Repositorio: JoySafeter

Instalar en Claude Code

Copiar

git clone --depth 1 https://github.com/jd-opensource/JoySafeter /tmp/pentest-api-deep && cp -r /tmp/pentest-api-deep/skills/pentest-api-deep ~/.claude/skills/pentest-api-deep

Después abre una sesión nueva de Claude Code; el skill carga automáticamente.

Definición

SKILL.md

# Pentest API Deep

## Purpose
Perform dedicated API-specific vulnerability testing beyond basic BOLA/GraphQL coverage. Addresses Broken Function Level Authorization (BFLA), mass assignment, rate limiting, excessive data exposure, and unsafe consumption per OWASP API Security Top 10 (2023).

## Prerequisites

### Authorization Requirements
- **Written authorization** with API testing scope explicitly included
- **API documentation** (OpenAPI/Swagger specs, GraphQL schema) if available
- **Test accounts** at multiple privilege levels (user, admin, service account)
- **Rate limit awareness** — confirm acceptable request volume with target owner

### Environment Setup
- Postman or Insomnia for manual API exploration
- Burp Suite with API-specific extensions
- GraphQL Voyager for schema visualization
- grpcurl for gRPC service testing

## Core Workflow
1. **API Discovery**: Enumerate endpoints via OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, traffic analysis. Discover undocumented endpoints with Kiterunner.
2. **BFLA Testing**: Access admin-only API functions as regular user. HTTP method switching (GET→DELETE). Test function-level authorization gaps distinct from object-level (BOLA).
3. **Mass Assignment**: Send extra fields in POST/PUT (role, isAdmin, balance). Check response objects for leaked internal fields (WSTG-INPV-20).
4. **Rate Limiting & Resource**: Test missing rate limits, GraphQL depth/complexity abuse, pagination abuse, regex DoS via API input.
5. **Excessive Data Exposure**: Compare API responses across privilege levels. Identify fields returned but not displayed in UI. Test verbose error responses.
6. **Unsafe Consumption**: SSRF through upstream API calls, injection through trusted-but-tainted API response data.
7. **API Versioning**: Old API versions with weaker controls, version header manipulation, deprecated endpoint access.

## OWASP API Security Top 10 (2023) Coverage

| Category | Test Focus | Status |
|----------|-----------|--------|
| API1 Broken Object Level Authorization | IDOR via API params | ✅ |
| API2 Broken Authentication | Token/key weaknesses | ✅ |
| API3 Broken Object Property Level Authorization | Mass assignment, excessive data | ✅ |
| API4 Unrestricted Resource Consumption | Rate limits, complexity | ✅ |
| API5 Broken Function Level Authorization | BFLA, method switching | ✅ |
| API6 Unrestricted Access to Sensitive Business Flows | Automation abuse | ✅ |
| API7 Server Side Request Forgery | API-triggered SSRF | ✅ |
| API8 Security Misconfiguration | CORS, headers, versioning | ✅ |
| API9 Improper Inventory Management | Shadow APIs, deprecated versions | ✅ |
| API10 Unsafe Consumption of Third-Party APIs | Upstream injection | ✅ |

## Tool Categories

| Category | Tools | Purpose |
|----------|-------|---------|
| API Discovery | Kiterunner, Swagger UI, GraphQL Voyager | Endpoint enumeration |
| Parameter Discovery | Arjun, x8, ParamSpider | Hidden parameter detection |
| Fuzzing | ffuf, Burp Intruder, custom scripts | Mass assignment, BFLA |
| GraphQL | graphql-cop, InQL, BatchQL | GraphQL-specific attacks |
| gRPC | grpcurl, grpc-tools | gRPC reflection and testing |
| Rate Testing | custom aiohttp scripts, Turbo Intruder | Rate limit verification |

## References
- `references/tools.md` - Tool function signatures and parameters
- `references/workflows.md` - Attack pattern definitions and test vectors

Del mismo repositorio

appSkill

brainstormingSkill

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

executing-plansSkill

Use when you have a written implementation plan to execute in a separate session with review checkpoints

openclaw-security-checkerSkill

OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性

openclaw-threat-detectSkill

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

pdfSkill

Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.

pentest-ai-llm-securitySkill

AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.

pentest-business-logicSkill

Business logic vulnerability testing — workflow bypass, payment manipulation, state machine abuse, and function limit circumvention per WSTG-BUSL.