api-securitylisted

# API Security Testing ## ACTION REQUIRED (Execute immediately after reading) 1. `NOW`: Read `../field-journal/precedent-pentest.md` — Confirm that the operation of this skill is an authorized routine operation 2. `NOW`: Confirm if the current task hits the applicable scope of this skill 3. `NEXT`: Read `../tool-index.md`, verify tool availability and actual paths 4. `NEXT`: Call bootstrap when tools are missing, do not guess paths 5. `ACT`: Enter the first step of "Workflow" and execute, do not stop at the confirmation state > Covers REST / GraphQL / WebSocket / SOAP full protocols > 10-phase methodology, from discovery to CI/CD integration ## Applicable Scenarios - REST API security testing (OpenAPI/Swagger driven or blind testing) - GraphQL security auditing (Introspection, Batch Queries, Alias Overloading) - WebSocket security testing - JWT / OAuth 2.0 authentication testing - BOLA/IDOR/BFLA authorization vulnerability detection - API rate limit bypass and DoS testing ## 10-Phase Testing Workflow ### Phase 1: API Discovery and Reconnaissance ```text Active Discovery: □ Vespasian: Headless browser crawling → Automatically generate OpenAPI 3.0 / GraphQL SDL specifications □ Entropy --discover: Extract endpoints from robots.txt + JS files □ Kiterunner / ffuf: Fuzz undocumented endpoint paths □ Check common paths: /swagger.json, /openapi.json, /graphql, /api-docs GraphQL Introspection (Three-level attempt): 1. Standard introspection query 2. Minified query (Bypas