AI导哈

测试与安全

conducting-api-security-testing

mukul975/anthro…y-skills

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

  • 655 次安装
  • 3.5万 星标
  • 收录于

安装命令

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill conducting-api-security-testing

SKILL.md

Conducting API Security Testing

When to Use

  • Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses
  • Assessing the security of microservices architecture where APIs are the primary communication method
  • Validating that API gateway protections (rate limiting, authentication, input validation) are properly enforced
  • Testing third-party API integrations for data exposure and insecure configurations
  • Evaluating GraphQL APIs for introspection disclosure, query complexity attacks, and authorization bypasses

Do not use against APIs without written authorization, for load testing or denial-of-service testing unless explicitly scoped, or for testing production APIs that process real financial transactions without safeguards.

Prerequisites

  • API documentation (OpenAPI/Swagger, GraphQL schema, Postman collection) or application access to reverse-engineer the API
  • Burp Suite Professional configured to intercept API traffic with JSON/XML content type handling
  • Postman or Insomnia for organizing and replaying API requests across different authentication contexts
  • Valid API tokens or credentials at multiple privilege levels (unauthenticated, standard user, admin)
  • Target API base URL and version information

相关 Skills

testing-api-security-with-owasp-top-10mukul975/anthro…y-skillsSystematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.测试与安全807analyzing-api-gateway-access-logsmukul975/anthro…y-skillsParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.后端与数据库769analyzing-android-malware-with-apktoolmukul975/anthro…y-skillsPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.移动开发683acquiring-disk-image-with-dd-and-dcflddmukul975/anthro…y-skillsCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.设计与多媒体678testing-for-xss-vulnerabilitiesmukul975/anthro…y-skillsTests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.测试与安全677performing-web-application-penetration-testmukul975/anthro…y-skillsPerforms systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.测试与安全668