violin/skills/pentest/references/api-testing.md

API Security Testing Reference & Payload Patterns

1. SOAP API Testing

WSDL Enumeration

• Look for WSDL endpoints at ?wsdl, ?WSDL, /service.asmx?wsdl, /ws?wsdl.
• Parse operations, parameters, target namespaces, and bindings.

XML Injection & XXE via SOAP

• Test XML parameters for entity expansion (XXE):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Body>
    <GetUserRequest>
      <Username>&xxe;</Username>
    </GetUserRequest>
  </soapenv:Body>
</soapenv:Envelope>

SOAP Action Fuzzing

• Test SOAPAction header tampering, header omission, or specifying alternative operation names in SOAPAction vs the XML body.

---

2. GraphQL Testing

Introspection Queries

• Test if introspection is enabled:

{"query": "{ __schema { types { name fields { name type { name kind ofType { name } } } } } }"}

Batch Queries & Query Amplification

• Array-based batching: [{"query": "..."}, {"query": "..."}]
• Alias-based batching (bypassing rate limits on single endpoint):

query {
  u1: user(id: 1) { id username }
  u2: user(id: 2) { id username }
}

Field Suggestion & Alias Abuse

• Intentionally send typos in field names to leverage GraphQL field suggestion hints (e.g. usr -> Did you mean user?).

Mutation Testing & Depth/Complexity Controls

• Check for authorization missing on sensitive mutations (updateUser, deleteAccount, changePassword).
• Test deeply nested recursive queries to test query depth/complexity limiters.

Specialized GraphQL Tools

• graphql-cop: Static/dynamic analysis for GraphQL security misconfigurations (npx graphql-cop -t http://target/graphql).
• inql: GraphQL introspection scanner (inql -t http://target/graphql).

---

3. OWASP API Top 10 Patterns

Excessive Data Exposure

• Inspect raw HTTP response JSON objects for sensitive unrendered properties (password_hash, ssn, internal_role, is_admin, api_token).

Broken Object Level Authorization (IDOR / BOLA)

• Substitute resource identifiers in endpoint paths or query parameters (GET /api/v1/users/101 -> GET /api/v1/users/102).

Mass Assignment (Body Property Injection)

• Inject administrative or internal attributes into object creation/update payloads (POST /api/users or PUT /api/users/me):

{
  "email": "user@example.com",
  "role": "admin",
  "is_verified": true,
  "permissions": ["*"]
}

Broken Function Level Authorization (BFLA)

• Attempt accessing administrative API endpoints using regular user credentials (GET /api/admin/metrics, POST /api/v1/users/suppress).

Security Misconfiguration & Unsafe API Consumption

• Check CORS misconfigurations (Access-Control-Allow-Origin: * with credentials), verbose stack traces, default API keys, and missing security headers.

---

4. API Security Tooling Syntax

• Arjun (Parameter Fuzzing): arjun -u http://target/api/endpoint -m GET or arjun -u http://target/api/endpoint -m POST --json
• ffuf (API Endpoint & Route Fuzzing): prefer violin_ffuf(..., url="http://target/api/v1/FUZZ"), which resolves explicit, $SECLISTS, SecLists, and DIRB wordlists; for a raw command use -w <verified-existing-wordlist>.
• Nuclei (API Vulnerability Templates): violin_nuclei -u http://target/api -t exposure/,misconfiguration/
• kiterunner (API OpenAPI/Swagger Brute Force): kr scan http://target/api -w routes-large.kite