AI导哈

测试与安全

testing-api-security-with-owasp-top-10

mukul975/anthro…y-skills

Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.

  • 807 次安装
  • 3.5万 星标
  • 收录于

安装命令

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill testing-api-security-with-owasp-top-10

SKILL.md

Testing API Security with OWASP Top 10

When to Use

  • During authorized API penetration testing engagements
  • When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities
  • Before deploying new API endpoints to production environments
  • When reviewing API security posture against the OWASP API Security Top 10 (2023)
  • For validating API gateway security controls and rate limiting effectiveness

Prerequisites

  • Authorization: Written scope document covering all API endpoints to be tested
  • Burp Suite Professional: For intercepting and modifying API requests
  • Postman: For organizing and executing API test collections
  • ffuf: For API endpoint and parameter fuzzing
  • curl/httpie: Command-line HTTP clients for manual testing
  • API documentation: Swagger/OpenAPI spec, GraphQL schema, or API docs
  • jq: JSON processor for parsing API responses (apt install jq)

相关 Skills

analyzing-api-gateway-access-logsmukul975/anthro…y-skillsParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.后端与数据库769analyzing-android-malware-with-apktoolmukul975/anthro…y-skillsPerform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.移动开发683acquiring-disk-image-with-dd-and-dcflddmukul975/anthro…y-skillsCreate forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.设计与多媒体678testing-for-xss-vulnerabilitiesmukul975/anthro…y-skillsTests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.测试与安全677performing-web-application-penetration-testmukul975/anthro…y-skillsPerforms systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.测试与安全668conducting-api-security-testingmukul975/anthro…y-skillsConducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.测试与安全655