<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Security Scanners — API Reference

## OWASP API Security Top 10 (2023)

| ID | Vulnerability | Severity |
|----|--------------|----------|
| API1 | Broken Object Level Authorization (BOLA) | High |
| API2 | Broken Authentication | Critical |
| API3 | Broken Object Property Level Authorization | High |
| API4 | Unrestricted Resource Consumption | Medium |
| API5 | Broken Function Level Authorization | High |
| API6 | Unrestricted Access to Sensitive Business Flows | Medium |
| API7 | Server Side Request Forgery | High |
| API8 | Security Misconfiguration | Medium |
| API9 | Improper Inventory Management | Low |
| API10 | Unsafe Consumption of APIs | Medium |

## Testing Tools

```bash
# Burp Suite (headless)
java -jar burpsuite.jar --config-file=config.json --project-file=project.burp

# OWASP ZAP API scan
zap-api-scan.py -t https://api.example.com/openapi.json -f openapi

# Nuclei API templates
nuclei -t http/misconfiguration/ -u https://api.example.com

# Nikto
nikto -h https://api.example.com -Tuning 1234567890
```

## curl Testing Patterns

```bash
# BOLA/IDOR test
curl -s -H "Authorization: Bearer $TOKEN" https://api.example.com/users/1
curl -s -H "Authorization: Bearer $TOKEN" https://api.example.com/users/999

# Auth bypass
curl -s https://api.example.com/admin
curl -s -H "Authorization: Bearer " https://api.example.com/admin
curl -s -H "X-Forwarded-For: 127.0.0.1" https://api.example.com/admin

# Rate limit test
for i in $(seq 1 100); do curl -s -o /dev/null -w "%{http_code}\n" https://api.example.com/login; done | sort | uniq -c

# Injection
curl -s "https://api.example.com/search?q='; DROP TABLE users;--"
curl -s -H "Content-Type: application/json" -d '{"query": "{ __schema { types { name } } }"}' https://api.example.com/graphql

# Excessive data exposure
curl -s https://api.example.com/users/me | jq 'keys'

# Security headers check
curl -sI https://api.example.com | grep -iE '(x-content-type|x-frame|strict-transport|content-security)'
```

## Python requests Library

```python
import requests

# Session with auth
session = requests.Session()
session.headers.update({"Authorization": "Bearer token123"})

# GET with params
resp = session.get("https://api.example.com/users", params={"page": 1})

# POST JSON
resp = session.post("https://api.example.com/users", json={"name": "test"})

# Handle pagination
while url:
    resp = session.get(url)
    data = resp.json()
    url = data.get("next")

# Timeout and retries
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry
retry = Retry(total=3, backoff_factor=0.5)
session.mount("https://", HTTPAdapter(max_retries=retry))
```

## GraphQL Introspection

```bash
# Full introspection query
curl -s -H "Content-Type: application/json" \
  -d '{"query": "{ __schema { queryType { name } mutationType { name } types { name kind fields { name type { name kind } } } } }"}' \
  https://api.example.com/graphql
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No vulnerabilities found |
| 1 | Vulnerabilities detected |
| 2 | Scanner error or target unreachable |
