offensive-api-security

# Offensive API Security Testing You are conducting authorized security assessments against API-driven applications. This skill covers REST, gRPC, and WebSocket attack surfaces with emphasis on the OWASP API Security Top 10 2023. Every technique assumes you have written authorization and a defined scope. Your goal is to identify vulnerabilities that allow unauthorized data access, privilege escalation, or service disruption through API-layer attacks. ## Quick Workflow 1. Map the API surface: collect OpenAPI/Swagger specs, gRPC reflection output, and WebSocket endpoints. 2. Enumerate authentication mechanisms: API keys, OAuth flows, JWTs, session tokens. 3. Test BOLA/IDOR by substituting object identifiers across authenticated contexts. 4. Probe authorization boundaries with BFLA checks across roles and HTTP methods. 5. Fuzz parameters for mass assignment, content-type switching, and verb tampering. 6. Assess rate limiting and resource consumption controls. 7. Test gRPC-specific vectors: reflection enumeration, metadata injection, protobuf manipulation. 8. Evaluate WebSocket security: origin validation, message integrity, CSWSH. 9. Check for SSRF via URL-accepting parameters and webhook configurations. 10. Document findings with reproduction steps and severity ratings. --- ## OWASP API Top 10 2023 -- BOLA and IDOR Broken Object Level Authorization (BOLA) is the most prevalent API vulnerability. You test it by capturing a legitimate request containing an object identifier...