npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using OWASP Top 10, Burp Suite, and Postman.
Conducts security testing on REST, GraphQL, and gRPC APIs using OWASP API Top 10, Burp Suite, Postman, and scripts to identify auth, authorization, injection, and business logic vulnerabilities at all permission levels.
Assesses REST and GraphQL API endpoints against OWASP API Security Top 10 risks using ffuf fuzzing, Burp Suite, Postman collections, and manual curl tests. For authorized pen testing before production.
Share bugs, ideas, or general feedback.
Do not use against APIs without written authorization, for load testing or denial-of-service testing unless explicitly scoped, or for testing production APIs that process real financial transactions without safeguards.
Map the complete API attack surface:
{"query": "{__schema{types{name,fields{name,args{name,type{name}}}}}}"}
/api/v1/, /api/v2/, /api/internal/), debug endpoints (/api/debug, /api/health, /api/metrics), and administrative endpointsTest authentication mechanisms for weaknesses:
alg to none and remove the signaturealg from RS256 to HS256 and sign with the public keyhashcat -m 16500 jwt.txt wordlist.txtTest for Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA):
GET /api/users/123/orders -> GET /api/users/456/ordersDELETE /api/users/456 (admin-only delete)PUT /api/users/456/role (role modification)GET /api/admin/dashboard (admin panel data)PUT /api/users/123
{"name": "Test", "role": "admin", "isVerified": true, "balance": 99999}
Test API inputs for injection and validation flaws:
{"username": "admin' OR 1=1--", "password": "test"}{"username": {"$gt": ""}, "password": {"$gt": ""}}Check for excessive data exposure in API responses:
/api/users?page=1, page=2, etc.) to extract all records/api/debug, /api/status, /metrics, /health, /.env, /api/swagger.json for exposed internal information| Term | Definition |
|---|---|
| BOLA | Broken Object Level Authorization (OWASP API #1); failure to verify that the requesting user is authorized to access a specific object, enabling IDOR attacks |
| BFLA | Broken Function Level Authorization (OWASP API #5); failure to restrict administrative or privileged API functions from being accessed by lower-privilege users |
| Mass Assignment | A vulnerability where the API binds client-provided data to internal object properties without filtering, allowing attackers to modify fields they should not have access to |
| GraphQL Introspection | A built-in GraphQL feature that exposes the complete API schema including all types, fields, and relationships; should be disabled in production |
| JWT | JSON Web Token; a self-contained token format used for API authentication containing claims signed with a secret or key pair |
| Rate Limiting | Controls that restrict the number of API requests a client can make within a time window, preventing brute force, enumeration, and abuse |
Context: A fintech startup has a mobile banking application with a REST API backend. The API handles account management, fund transfers, bill payments, and transaction history. The tester has Swagger documentation and accounts at user and admin levels.
Approach:
/api/v1/accounts/{accountId}/transactions allowing any authenticated user to view any account's transaction history"dailyTransferLimit": 999999 bypasses the configured transfer limit/api/v1/admin/users is accessible with a standard user token (BFLA)Pitfalls:
## Finding: Broken Object Level Authorization in Transaction History API
**ID**: API-001
**Severity**: Critical (CVSS 9.1)
**Affected Endpoint**: GET /api/v1/accounts/{accountId}/transactions
**OWASP API Category**: API1:2023 - Broken Object Level Authorization
**Description**:
The transaction history endpoint returns all transactions for the specified
account without verifying that the authenticated user owns the account. Any
authenticated user can view the complete transaction history of any account
by substituting the accountId path parameter.
**Proof of Concept**:
1. Authenticate as User A (account ID: ACC-10045)
2. Request: GET /api/v1/accounts/ACC-10046/transactions
Authorization: Bearer <User_A_token>
3. Response: 200 OK with User B's full transaction history
**Impact**:
Any authenticated user can view the complete financial transaction history of
all 45,000 customer accounts, including amounts, dates, recipients, and
transaction descriptions.
**Remediation**:
Implement server-side authorization check that verifies the authenticated user
owns the requested account before returning data:
const account = await Account.findById(accountId);
if (account.userId !== req.user.id) return res.status(403).json({error: "Forbidden"});