skills.rest
narlyseorg
narlyseorgCOMMUNITY
Explore all skills by this author →
GitHub

api-pentesting

Identify and assess API security vulnerabilities across REST, GraphQL, gRPC, WebSocket, and SOAP endpoints.

6|1|Updated Mar 1, 2026
Search Tags:#testing#authorization#security#vulnerability#api#endpoints#pentesting
One-click install
npx skills add https://github.com/narlyseorg/superhackers --skill api-pentesting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-pentesting
Source: https://github.com/narlyseorg/superhackers/tree/main/skills/api-pentesting
Command: npx skills add https://github.com/narlyseorg/superhackers --skill api-pentesting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

APIs are often the primary attack surface in modern software, and this Skill provides a structured workflow to identify security weaknesses, verify authorization controls, and document findings for remediation across REST, GraphQL, gRPC, WebSocket, and SOAP endpoints.

Core Features & Use Cases

  • Discover API surfaces and map endpoints, methods, and documentation.
  • Test authentication, authorization, input validation, and business-logic constraints across multiple API types.
  • Generate actionable findings with evidence, risk ratings, and remediation steps for security assessments, pentests, and secure development lifecycles.

Quick Start

Analyze an in-scope API by enumerating endpoints, validating access controls, and capturing reproducible evidence to inform a secure remediation plan.

Frequently Asked Questions about api-pentesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test API authorization and authentication controls across different protocols?▼

API security testing evaluates authentication and authorization vulnerabilities across REST, GraphQL, gRPC, WebSocket, and SOAP endpoints. It guides surface discovery, access control validation, and input checks to identify security weaknesses.

What is the best way to discover API endpoints and map the attack surface?▼

API surface discovery maps endpoints, methods, and documentation to identify the attack surface. This structured workflow enumerates available API endpoints to verify in-scope targets before conducting deep security testing.

Can I test business-logic abuse scenarios and input validation for GraphQL and gRPC?▼

Yes, API pentesting includes testing business-logic constraints and input validation across GraphQL and gRPC endpoints. It assesses authorization controls and captures reproducible evidence to verify business-logic abuse scenarios.

Does API pentesting generate structured findings with remediation steps for security assessments?▼

API pentesting generates actionable findings with evidence, risk ratings, and remediation steps suitable for verification. This structured output directly informs secure development lifecycles and remediation planning for security assessments.

How do I start an API security assessment workflow for in-scope endpoints?▼

Start an API security assessment by enumerating in-scope endpoints, validating access controls, and capturing reproducible evidence. This coordinated tool usage outputs structured findings to inform a secure remediation plan.

What are the limitations of automated API vulnerability assessment for modern software?▼

API vulnerability assessment requires output validation and coordinated tool usage to avoid false positives. While it identifies input validation flaws and authorization weaknesses, complex business-logic abuse scenarios often require manual verification.

Related Skills

Explore More Software Engineering Skills→
profbernardojprofbernardoj

api-helper

Automates verification and configuration of API credentials for reliable access.

Community
Intermediate
johngutierrez31johngutierrez31

vulnerability-priority-engine

Score vulnerabilities by exploitability, exposure, impact, and remediation effort.

Community
Intermediate
AcczdyAcczdy
2

testing-api-security-with-owasp-top-10

Assess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.

Community
Intermediate
infantesromeroadrianinfantesromeroadrian

transilience-api-security

Test GraphQL, REST, WebSocket, and LLM-integrated APIs for security vulnerabilities.

Community
Advanced