<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-api-vulnerability-assessment
description: >-
  Assess REST, GraphQL, and gRPC APIs for OWASP API Top 10 vulnerabilities using
  nuclei, OWASP ZAP API scan, and custom fuzzing. Covers authentication bypass,
  BOLA/IDOR, mass assignment, rate limiting, and injection testing.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - api-security
  - owasp-api-top-10
  - nuclei
  - zap
  - fuzzing
  - bola
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing API Vulnerability Assessment

## Overview

APIs are the primary attack surface for modern applications. The OWASP API Security
Top 10 identifies critical risks: Broken Object Level Authorization (BOLA), broken
authentication, excessive data exposure, lack of rate limiting, and injection flaws.
This skill covers automated and manual API security testing workflows.

## Prerequisites

| Requirement | Install |
|---|---|
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| OWASP ZAP | `docker pull ghcr.io/zaproxy/zaproxy:stable` |
| ffuf | `go install github.com/ffuf/ffuf/v2@latest` |
| httpx | `go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest` |
| Python 3.10+ | Agent tooling |

## Key Concepts

### API Endpoint Discovery

```bash
# Discover API endpoints from OpenAPI/Swagger spec
curl -s https://target.example.com/openapi.json | \
  jq '.paths | keys[]' -r | sort

# Fuzz for common API paths
ffuf -u https://target.example.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,201,401,403 -o api_endpoints.json -of json

# Discover GraphQL endpoints
nuclei -u https://target.example.com -tags graphql -json -o graphql_disco.json

# httpx probe for live API endpoints
cat api_urls.txt | httpx -status-code -content-length -title -json -o live_apis.json
```

### OWASP API Top 10 Testing

```bash
# ZAP API scan from OpenAPI spec
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://target.example.com/openapi.json -f openapi -J zap_api.json

# nuclei API security templates
nuclei -u https://target.example.com/api/v1/ \
  -tags api,owasp-api -severity critical,high,medium \
  -json -o api_findings.json

# BOLA/IDOR testing — iterate object IDs
for id in $(seq 1 100); do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $USER_A_TOKEN" \
    "https://target.example.com/api/v1/users/$id")
  if [ "$STATUS" = "200" ]; then
    echo "BOLA: Accessible /users/$id with User A token"
  fi
done

# Mass assignment testing
curl -X PUT https://target.example.com/api/v1/users/me \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","role":"admin","is_admin":true}' -v

# Rate limit testing
for i in $(seq 1 200); do
  curl -s -o /dev/null -w "%{http_code}\n" \
    "https://target.example.com/api/v1/login" \
    -d '{"user":"test","pass":"wrong"}' &
done | sort | uniq -c | sort -rn
```

### GraphQL-Specific Testing

```bash
# GraphQL introspection query
curl -s -X POST https://target.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name fields { name } } } }"}' | jq '.data'

# Batch query abuse
curl -s -X POST https://target.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '[{"query":"{ user(id:1) { email } }"},{"query":"{ user(id:2) { email } }"}]'

# nuclei GraphQL vulnerability scan
nuclei -u https://target.example.com/graphql -tags graphql \
  -severity critical,high -json -o graphql_vulns.json
```

### JWT Testing

```bash
# Decode JWT without verification
echo "$JWT_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq .

# Test "none" algorithm bypass
nuclei -u https://target.example.com -tags jwt -json -o jwt_findings.json
```

## Workflow

1. **Discover** — Map all API endpoints from specs, fuzzing, and traffic analysis
2. **Authenticate** — Obtain tokens for different privilege levels
3. **BOLA test** — Access objects belonging to other users with each token
4. **Injection test** — SQL, NoSQL, command injection in all parameters
5. **Auth test** — Test JWT bypass, token reuse, privilege escalation
6. **Rate limit** — Verify API rate limiting on auth and sensitive endpoints
7. **Report** — Map findings to OWASP API Top 10 categories

## Detection

```yaml
title: Api Vulnerability Assessment Detection
id: ab764bcf-c5b2-42a2-808c-2074a02c489b
status: experimental
description: Detects suspicious activity related to performing api vulnerability assessment techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*api*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Endpoints discovered | API path list is comprehensive |
| Auth tokens valid | Authenticated requests return 200 |
| BOLA confirmed | Cross-user object access succeeds |
| Rate limits present | 429 responses after threshold |
| Injection blocked | Malicious payloads return errors, not data |

## References

- [OWASP API Security Top 10](https://owasp.org/API-Security/)
- [nuclei API Templates](https://github.com/projectdiscovery/nuclei-templates/tree/main/http/vulnerabilities)
- [GraphQL Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html)
- [JWT Security Best Practices](https://datatracker.ietf.org/doc/html/rfc8725)
