evandrodevbr
c17192c9fe
Copia local (nao fork, nao submodule) de safedeps, sca-audit, secrets-scan, code-review-security, api-security-review, web-security-review, cve-triage, patch-prioritization, dependency-scanning e hermaguard -- commit exato de origem e licenca de cada uma em skills/NOTICE.md. Elimina o passo de clone externo pro pilar de seguranca do wf-security-review: git clone deste repo ja traz tudo funcional. Corrige tambem o comando de instalacao pro Claude Code nos dois READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o comando antigo copiava -- confirmado testando a instalacao real.
63 lines
2.9 KiB
Markdown
63 lines
2.9 KiB
Markdown
---
|
|
name: api-security-review
|
|
description: Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.
|
|
license: CC-BY-4.0
|
|
---
|
|
|
|
# API Security Review
|
|
|
|
Perform comprehensive API security assessment following `plays/api-security-review.md`.
|
|
|
|
## Steps
|
|
|
|
1. **Discovery & Reconnaissance**
|
|
- Parse OpenAPI/Swagger specs or scan code for endpoints
|
|
- Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
|
|
- Map API gateway and middleware configurations
|
|
- Enumerate all API versions and deprecated endpoints
|
|
|
|
2. **Authentication Deep Dive**
|
|
- JWT security (algorithm confusion, weak signing, token expiration)
|
|
- OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
|
|
- API key exposure and rotation policies
|
|
- Session management and token storage
|
|
|
|
3. **Assess All 10 OWASP API Risks** with attack scenarios:
|
|
- **API1 BOLA** — IDOR via predictable IDs, batch endpoint bypasses, ownership verification gaps
|
|
- **API2 Broken Authentication** — JWT attacks, OAuth flaws, brute force, credential stuffing
|
|
- **API3 BOPA** — Mass assignment, response over-exposure, field-level authz bypasses
|
|
- **API4 Resource Consumption** — Rate limit bypasses, pagination abuse, GraphQL DoS
|
|
- **API5 BFLA** — Admin endpoint discovery, horizontal/vertical privilege escalation
|
|
- **API6 Business Flows** — Automated abuse, inventory exhaustion, scraping attacks
|
|
- **API7 SSRF** — URL bypasses, DNS rebinding, cloud metadata access
|
|
- **API8 Misconfiguration** — CORS bypasses, verbose errors, missing headers
|
|
- **API9 Inventory** — Shadow APIs, zombie endpoints, version confusion
|
|
- **API10 Unsafe Consumption** — XXE, deserialization, webhook replay attacks
|
|
|
|
4. **Automated Testing**
|
|
- Run API security scanners (OWASP ZAP, Burp Suite, Postman tests)
|
|
- Test for common vulnerabilities with specific payloads
|
|
- Validate rate limiting and throttling mechanisms
|
|
|
|
5. **API Gateway & Infrastructure Review**
|
|
- Kong, nginx, Envoy, AWS API Gateway configurations
|
|
- WAF rules and bypass opportunities
|
|
- TLS configuration and certificate validation
|
|
|
|
## Output
|
|
|
|
Comprehensive API security report including:
|
|
- API surface inventory with authentication mechanisms
|
|
- Risk matrix with severity ratings for all 10 categories
|
|
- Detailed findings with proof-of-concept examples
|
|
- Exploit scenarios and business impact analysis
|
|
- Prioritized remediation roadmap with code examples
|
|
- Testing artifacts and vulnerability evidence
|
|
|
|
## OWASP References
|
|
|
|
- OWASP API Security Top 10 (2023)
|
|
- OWASP ASVS v5.0 — V13: API and Web Service
|
|
- OWASP Testing Guide: WSTG-APIT
|
|
- OWASP Cheat Sheet: REST Security, GraphQL Security, JWT Security, OAuth 2.0
|