atest

Automate end-to-end API security testing across REST, GraphQL, and gRPC.

Updated Jun 23, 2024

Search Tags:#automation #security #api #graphql #pentest #idor #bola

Ready to run

npx skills add https://github.com/n4igme/randscript --skill atest

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: atest
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/atest
Command: npx skills add https://github.com/n4igme/randscript --skill atest

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Lightweight API penetration testing framework for REST, GraphQL, and gRPC targets. It enables rapid, phase-driven security assessments without requiring full infrastructure setup.

Core Features & Use Cases

4-phase workflow: Scope & Recon, AuthN/AuthZ, Injection & Logic, Reporting.
Phase-driven tooling: token management, BOLA/IDOR testing, and PoC generation across phases.
Scripted helpers and references: integrates with state_manager.py and bola_scanner.py, with references for deeper guidance.

Quick Start

Provide a base URL and credentials, initialize an atest engagement, and proceed through Phase 1 recon, Phase 2 auth tests, Phase 3 injections, and Phase 4 reporting.

Frequently Asked Questions about atest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate API security testing for BOLA and IDOR vulnerabilities?▼

Automate API security testing for BOLA and IDOR using a 4-phase workflow that maps endpoints, validates authorization, and runs scripted checks to detect broken object level authorization across REST, GraphQL, and gRPC targets.

What is the best way to pentest GraphQL and gRPC APIs for authorization flaws?▼

The best way to pentest GraphQL and gRPC APIs is a phase-driven assessment that validates AuthN and AuthZ, maps endpoints, and generates structured reports with proof of concepts for data exposure risks.

How do I start an API pentest engagement with phase gates?▼

Start an API pentest engagement by providing a base URL and credentials, initializing the scope, and proceeding sequentially through recon, auth tests, injections, and reporting phase gates.

Do I need to provide tokens for automated API security testing?▼

Yes, automated API security testing requires token management to validate authentication and authorization, test injections, and accurately detect BOLA, IDOR, and data exposure risks across endpoints.

Can I generate proof of concept reports for REST API injections automatically?▼

Yes, you can generate structured reports with PoCs for REST API injections automatically by completing the injection and logic testing phase and proceeding to the reporting phase of the workflow.