skills.rest
abisheikM1
abisheikM1COMMUNITY
Explore all skills by this author →
GitHub

api-vuln-test

Tests backend API endpoints for IDOR, broken auth, and access control flaws via Burp replay.

48|27|Updated Jul 30, 2026
Search Tags:#access control#android#pentesting#api security#idor#burp suite#owasp api top 10
One-click install
npx skills add https://github.com/abisheikM1/Tribunal --skill api-vuln-test-abisheikm1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-vuln-test
Source: https://github.com/abisheikM1/Tribunal/tree/main/skills/api-vuln-test
Command: npx skills add https://github.com/abisheikM1/Tribunal --skill api-vuln-test-abisheikm1

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Mobile app pentesters often stop at client-side findings, but the highest-impact bugs live in the backend API the app talks to. This Skill turns intercepted Burp traffic and static analysis into a systematic OWASP API Top 10 testing workflow with structured, evidence-backed findings. ## Core Features & Use Cases - Endpoint Enumeration: Merges endpoints from threat_model.json (static decompilation) and Burp proxy history exports, deduplicating paths like /users/1 and /users/2 into /users/{id}. - OWASP API Top 10 Testing: Guides testing for IDOR/BOLA, broken authentication, BFLA, mass assignment, injection, business-logic flaws, SSRF, and GraphQL weaknesses by replaying modified requests in Burp. - Structured Findings Output: Writes confirmed vulnerabilities with saved request/response evidence to api_findings.json for downstream reporting. - Use Case: After intercepting an app's HTTPS traffic, you export Burp history, run the enumerator, then test each authenticated endpoint by swapping object IDs between two accounts you control to confirm an IDOR that leaks other users' PII. ## Quick Start Ask the agent to test the app's backend API for IDOR and broken access control using the Burp export and threat model for the current target hash.

Frequently Asked Questions about api-vuln-test

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a mobile app's API for IDOR vulnerabilities?▼

Intercept the app's traffic in Burp, then replay authenticated requests while swapping object IDs (numeric IDs, UUIDs, account parameters) to another account you control. An IDOR is confirmed when you read or modify data belonging to the other account.

How to enumerate API endpoints from Burp proxy history?▼

Export Burp history via Save items as XML, or copy request lines into a text file, then run extract_endpoints.py with the --burp flag. It parses both formats, merges them with static endpoints from threat_model.json, and deduplicates numeric path segments.

What is the difference between BOLA and BFLA in API testing?▼

BOLA (API1) is object-level: accessing another user's data by changing object references like /users/{id}. BFLA (API5) is function-level: calling privileged or admin routes as a normal user, or flipping HTTP methods like GET to DELETE.

Does this API testing work without Burp Suite?▼

No. The workflow depends on Burp Suite for intercepting HTTPS traffic and replaying modified requests in Repeater. The bundled script only enumerates endpoints; actual testing is manual replay against in-scope hosts.

What are the scope and authorization requirements for API testing?▼

Testing is restricted to hosts listed in the authorized program's API scope, verified by the scope_gate.py check which exits with code 3 on refusal. Only your own authenticated sessions and accounts you control may be replayed, with no destructive payloads.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced
enderphan94enderphan94
1

validate-scan

Validate security scan findings by assessing evidence and reducing false positives.

Community
Advanced
Wyl-cmdWyl-cmd
6

hunt-open-redirect

Detects and exploits open redirect vulnerabilities including OAuth redirect_uri bypass chains.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced