Offensive API Security Testing

You are conducting authorized security assessments against API-driven applications. This skill covers REST, gRPC, and WebSocket attack surfaces with emphasis on the OWASP API Security Top 10 2023. Every technique assumes you have written authorization and a defined scope. Your goal is to identify vulnerabilities that allow unauthorized data access, privilege escalation, or service disruption through API-layer attacks.

Quick Workflow

1. Map the API surface: collect OpenAPI/Swagger specs, gRPC reflection output, and WebSocket endpoints.
2. Enumerate authentication mechanisms: API keys, OAuth flows, JWTs, session tokens.
3. Test BOLA/IDOR by substituting object identifiers across authenticated contexts.
4. Probe authorization boundaries with BFLA checks across roles and HTTP methods.
5. Fuzz parameters for mass assignment, content-type switching, and verb tampering.
6. Assess rate limiting and resource consumption controls.
7. Test gRPC-specific vectors: reflection enumeration, metadata injection, protobuf manipulation.
8. Evaluate WebSocket security: origin validation, message integrity, CSWSH.
9. Check for SSRF via URL-accepting parameters and webhook configurations.
10. Document findings with reproduction steps and severity ratings.