api-security-testing

原文涵盖的主题

• API Security Testing Workflow
• Overview
• When to Use This Workflow
• Workflow Phases
• Phase 1: API Discovery
• Skills to Invoke
• Actions
• Copy-Paste Prompts

Specialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities. Use this workflow when: Testing REST API security Assessing GraphQL endpoints Validating API authentication Testing API rate limiting Bug bounty API testing api-fuzzing-bug-bounty - API fuzzing scanning-tools - API scanning 1. Enumerate endpoints 2. Document API methods 3. Identify parameters 4. Map data flows 5. Review documentation broken-authentication - Auth testing api-security-best-practices - API auth 1. Test API key validation 2. Test JWT tokens 3. Test OAuth2 flows 4. Test token expiration 5. Test refresh tokens idor-testing - IDOR testing 1. Test object-level authorization 2. Test function-level authorization 3. Test role-based access 4. Test privilege escalation 5. Test multi-tenant isolation api-fuzzing-bug-bounty - API fuzzing sql-injection-testing - Injection testing 1. Test parameter validation 2. Test SQL injection 3. Test NoSQL injection 4. Test command injection 5. Test XXE injection api-security-best-practices - Rate limiting 1. Test rate limit headers 2. Test brute force protection 3. Test reso

这里只展示节选，请以完整原文和当前要求为准。