skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-api-security-with-owasp-top-10

Probe REST and GraphQL APIs for OWASP API Security Top 10 risks.

Updated Jan 29, 2024
Search Tags:#rate limiting#owasp#graphql#rest api#api security#security reporting#authorization testing
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-api-security-with-owasp-top-10-riandeoliveira
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-api-security-with-owasp-top-10
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/testing-api-security-with-owasp-top-10
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-api-security-with-owasp-top-10-riandeoliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, urllib3, argparse, json, datetime, and includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps teams systematically identify authorization, authentication, exposure, rate-limiting, and misconfiguration weaknesses across REST and GraphQL APIs by mapping findings to the OWASP API Security Top 10.

Core Features & Use Cases

  • Endpoint discovery and mapping: Enumerate API paths, supported versions, and likely GraphQL entry points using Swagger/OpenAPI and fuzzing so you test the real surface area.
  • Targeted OWASP Top 10 checks: Validate key risk categories such as BOLA (API1), broken authentication (API2), excessive data exposure and mass assignment (API3), rate limiting and sensitive-flow controls (API4/6), and privilege checks for admin functions (API5).
  • Automated assessment reporting: Run scripted checks for security headers, CORS, API version exposure, login rate limiting, BOLA signals, and data exposure, then compile results into a machine-readable JSON report.

Quick Start

Run the automated OWASP Top 10 assessment script against your authorized test environment and export the results to a JSON report.

Frequently Asked Questions about testing-api-security-with-owasp-top-10

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate OWASP API security top 10 testing for REST and GraphQL endpoints?▼

Testing GraphQL APIs for security misconfigurations involves probing common GraphQL paths for authorization weaknesses and data exposure. This Skill includes targeted checks for GraphQL entry points alongside REST endpoint discovery.

How do I evaluate login rate limiting and sensitive API flow controls?▼

Evaluating login rate limiting requires executing repeated HTTP requests against authentication flows to verify throttling controls. This Skill automates login rate limiting evaluation and maps failures to the OWASP API4 and API6 risk categories.

Can I test APIs with bearer-token authentication using this OWASP security tool?▼

Bearer-token authentication is supported for HTTP request execution during authorized penetration testing and pre-production security validation. This Skill requires bearer-token support to iterate endpoints and fuzz API versions.

What's the best way to generate machine-readable security reports for API vulnerabilities?▼

Generating machine-readable security reports involves compiling endpoint discovery, security header checks, and CORS validation results into structured JSON output. This Skill groups vulnerability findings by severity for automated assessment reporting.

Related Skills

Explore More Legal & Compliance Skills→
xloxn69xloxn69
7

api-documentation-generator

Generate OpenAPI 3.0 YAML/JSON specifications for REST API endpoints.

Community
Basic
Probably-GroupProbably-Group
3

security-auditing

Conduct security audits, classify findings by severity and CWE, and produce remediation reports.

Official
Advanced
AcczdyAcczdy
2

testing-api-security-with-owasp-top-10

Assess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.

Community
Intermediate
xalgordxalgord
846

idor

Detect and validate object-level authorization failures across APIs, web, mobile, and microservices.

Community
Advanced