API Security Router

This is the routing entry point for API security testing.

Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.

When to Use

• The target exposes REST APIs, mobile backends, or GraphQL endpoints
• You need to define API testing order before going into specific topics
• You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks

Skill Map

• API Recon and Docs: OpenAPI, Swagger, version drift, hidden documentation
• API Authorization and BOLA: BOLA, BFLA, method abuse, hidden writable fields
• API Auth and JWT Abuse: bearer token, header trust, claim abuse, rate-limit bypass
• GraphQL and Hidden Parameters: introspection, batching, undocumented fields, hidden parameters

Quick Triage

Recommended Flow

1. Start with exposed endpoints and documentation assets
2. Then evaluate object-level and function-level authorization
3. Then evaluate token, header, signature, and rate-limit boundaries

   發現更多技能外掛，請訪問7w4.net。

4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse

Related Categories

• auth-sec
• business-logic-vuln
• recon-for-sec

這是一個偏向框架性質的API安全測試入口技能，優點是分類清晰、流程明確，能幫助理清API安全測試的思路。但實際內容較為單薄，主要是路由指引而缺乏具體的測試方法和技術細節，且依賴的子模組並未包含在包中。作為獨立Skill使用價值有限，適合作為學習參考但難以直接用於真實安全測試場景。