davila7--claude-code-templates
wehub-resource-sync
1 行
3.7 KiB
JSON
1 行
3.7 KiB
JSON
{"content": "---\nname: api-security-testing\ndescription: \"API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.\"\ncategory: granular-workflow-bundle\nrisk: safe\nsource: personal\ndate_added: \"2026-02-27\"\n---\n\n# API Security Testing Workflow\n\n## Overview\n\nSpecialized workflow for testing REST and GraphQL API security including authentication, authorization, rate limiting, input validation, and API-specific vulnerabilities.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Testing REST API security\n- Assessing GraphQL endpoints\n- Validating API authentication\n- Testing API rate limiting\n- Bug bounty API testing\n\n## Workflow Phases\n\n### Phase 1: API Discovery\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `scanning-tools` - API scanning\n\n#### Actions\n1. Enumerate endpoints\n2. Document API methods\n3. Identify parameters\n4. Map data flows\n5. Review documentation\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to discover API endpoints\n```\n\n### Phase 2: Authentication Testing\n\n#### Skills to Invoke\n- `broken-authentication` - Auth testing\n- `api-security-best-practices` - API auth\n\n#### Actions\n1. Test API key validation\n2. Test JWT tokens\n3. Test OAuth2 flows\n4. Test token expiration\n5. Test refresh tokens\n\n#### Copy-Paste Prompts\n```\nUse @broken-authentication to test API authentication\n```\n\n### Phase 3: Authorization Testing\n\n#### Skills to Invoke\n- `idor-testing` - IDOR testing\n\n#### Actions\n1. Test object-level authorization\n2. Test function-level authorization\n3. Test role-based access\n4. Test privilege escalation\n5. Test multi-tenant isolation\n\n#### Copy-Paste Prompts\n```\nUse @idor-testing to test API authorization\n```\n\n### Phase 4: Input Validation\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `sql-injection-testing` - Injection testing\n\n#### Actions\n1. Test parameter validation\n2. Test SQL injection\n3. Test NoSQL injection\n4. Test command injection\n5. Test XXE injection\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API parameters\n```\n\n### Phase 5: Rate Limiting\n\n#### Skills to Invoke\n- `api-security-best-practices` - Rate limiting\n\n#### Actions\n1. Test rate limit headers\n2. Test brute force protection\n3. Test resource exhaustion\n4. Test bypass techniques\n5. Document limitations\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to test rate limiting\n```\n\n### Phase 6: GraphQL Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - GraphQL fuzzing\n\n#### Actions\n1. Test introspection\n2. Test query depth\n3. Test query complexity\n4. Test batch queries\n5. Test field suggestions\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to test GraphQL security\n```\n\n### Phase 7: Error Handling\n\n#### Skills to Invoke\n- `api-security-best-practices` - Error handling\n\n#### Actions\n1. Test error messages\n2. Check information disclosure\n3. Test stack traces\n4. Verify logging\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @api-security-best-practices to audit API error handling\n```\n\n## API Security Checklist\n\n- [ ] Authentication working\n- [ ] Authorization enforced\n- [ ] Input validated\n- [ ] Rate limiting active\n- [ ] Errors sanitized\n- [ ] Logging enabled\n- [ ] CORS configured\n- [ ] HTTPS enforced\n\n## Quality Gates\n\n- [ ] All endpoints tested\n- [ ] Vulnerabilities documented\n- [ ] Remediation provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `security-audit` - Security auditing\n- `web-security-testing` - Web security\n- `api-development` - API development\n"} |