testing-api-security-with-owasp-top-10

Assess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.

2|Updated Apr 14, 2026

Search Tags:#owasp #graphql #api-security #penetration-testing #fuzzing #rest-api #burpsuite

Ready to run

npx skills add https://github.com/Acczdy/MoZiSec --skill testing-api-security-with-owasp-top-10

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: testing-api-security-with-owasp-top-10
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/testing-api-security-with-owasp-top-10
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill testing-api-security-with-owasp-top-10

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, urllib3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a structured, repeatable approach to identify common API security weaknesses defined in the OWASP API Security Top 10, reducing the risk of broken authentication, object-level authorization failures, excessive data exposure, SSRF, and related issues that lead to data leaks or privilege escalation.

Core Features & Use Cases

Automated checks for security headers, CORS misconfigurations, and deprecated API versions to detect misconfiguration and inventory issues.
Active testing routines for BOLA (IDOR), broken authentication, mass assignment, rate limiting, SSRF, and other OWASP API risks with optional token-based authenticated scans.
Use Case: run during authorized penetration tests or pre-deployment reviews to map endpoints, fuzz parameters, verify authz/authn controls, and generate a JSON findings report.

Quick Start

Run the agent against the target API with an authorized token to scan endpoints for OWASP API Security Top 10 issues.

Frequently Asked Questions about testing-api-security-with-owasp-top-10

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test my REST API for OWASP Top 10 vulnerabilities?▼

To test REST APIs for OWASP Top 10 vulnerabilities, you can map endpoints, fuzz parameters, and validate authentication and authorization controls using automated scripts designed for authorized penetration tests.

Can I scan GraphQL endpoints for broken object level authorization?▼

Yes, you can scan GraphQL endpoints for BOLA and other authorization failures by fuzzing parameters and inspecting responses to detect excessive data exposure or privilege escalation during active testing.

Do I need authentication tokens to run an API security scan?▼

Optional bearer tokens are required for authenticated scans to verify authorization controls and test for vulnerabilities like IDOR, while unauthenticated checks can assess security headers and CORS misconfigurations.

How do I detect SSRF and mass assignment vulnerabilities in APIs?▼

You can detect SSRF and mass assignment vulnerabilities through active testing routines that fuzz input parameters and inspect HTTP responses to identify unauthorized resource requests or unintended data modification.

What is the best way to audit API gateways for security misconfigurations?▼

Auditing API gateways for security misconfigurations involves automated checks for deprecated API versions, incorrect CORS policies, and missing security headers to map inventory issues and reduce data leak risks.

Does this approach work without Burpsuite for penetration testing?▼

Yes, the testing routines rely on standard HTTP request libraries like requests and urllib3 to perform fuzzing and header inspection, functioning independently of Burpsuite for pre-deployment API reviews.