API Security Testing Methodology: A 10-Phase Automated Framework

The reverse-skill repository defines API security testing as a disciplined, ten-phase workflow that automates the full assessment lifecycle—from endpoint discovery to CI/CD integration—while enforcing tool verification and reproducible evidence collection.

The zhaoxuya520/reverse-skill project structures API security assessments as a repeatable, agent-driven process rather than manual ad-hoc testing. According to the source code in skills/api-security/SKILL.md, the methodology implements a strict sequence of ten phases that guarantees comprehensive coverage, prevents guesswork, and produces auditable results for every engagement.

The 10-Phase API Security Testing Workflow

The methodology mandates that each phase completes before the next begins, with explicit tool checks via ../tool-index.md and evidence collection requirements at every step.

Phase 1: Discovery & Reconnaissance

Goal: Locate every reachable endpoint. Activities include headless crawling, automatic OpenAPI/GraphQL schema generation, extraction of endpoints from robots.txt and JavaScript files, and path brute-forcing. Representative tools include Vespasian, Entropy –discover, and ffuf.

Phase 2: Authentication Testing

Goal: Validate or break authentication mechanisms. This phase covers JWT attacks (algorithm confusion with alg:none, key-confusion, claim tampering, and KID injection), OAuth 2.0 redirect manipulation, CSRF via missing state parameters, and GraphQL mutation bypasses. Primary tools are jwt_tool and Burp Autorize.

Phase 3: Authorization (BOLA/IDOR/BFLA)

Goal: Test object-level and feature-level access controls. Testers perform ID traversal attacks (numeric, UUID, and username-based), HTTP method swaps, API version downgrade attempts, and batch-operation injection. Key tools include Burp Autorize and AuthMatrix.

Phase 4: GraphQL-Specific Testing

Goal: Exploit GraphQL-only vectors. This includes introspection leakage, alias overload attacks, batch query abuse, field duplication, directive abuse, recursive query construction, and GET-based mutation CSRF. Tools referenced are FireTail, Escape DAST, and api.sh.

Phase 5: REST Input Validation

Goal: Fuzz request payloads and headers. Activities cover method and Content-Type swaps, NoSQL injection, SSRF via URL parameters, XXE attacks, parameter pollution, and forced administrative flags. Entropy and custom payload scripts support this phase.

Phase 6: Business Logic & Differential Testing

Goal: Detect logic flaws and regressions. The methodology requires comparing v1 and v2 API specifications, role-matrix testing, coupon and price manipulation checks, and Time-of-Check-Time-of-Use (TOCTOU) race condition detection. Entropy compare functionality enables automated diff testing.

Phase 7: WebSocket Testing

Goal: Assess real-time API channels. Testing includes endpoint discovery, message injection, oversized payload handling, type confusion attacks, and Cross-Site WebSocket Hijacking (CSWH). Execution relies on custom WebSocket clients and Burp extensions.

Phase 8: Rate Limiting & DoS Assessment

Goal: Bypass throttling mechanisms or exhaust resources. Techniques include header-based rate limit bypasses, path variant enumeration, Slowloris-style low-bandwidth attacks, GraphQL deep-query DoS, and IP rotation via ProxyCat.

Phase 9: Data Exposure Analysis

Goal: Identify over-exposed information. Testers compare response data against UI presentations, enumerate pagination, identify verbose error messages, exploit GraphQL data traversal, and detect OpenAPI specification leaks. Manual diff analysis and Entropy support this phase.

Phase 10: CI/CD Integration

Goal: Automate testing within the build pipeline. The methodology enforces watching specification changes with Entropy --ci --watch, auto-running DAST with Escape DAST, and blocking builds on severe findings using StackHawk.

Key Implementation Files and Toolchain

The methodology relies on a hierarchical file structure that separates workflow definitions from technical references:

• skills/api-security/SKILL.md: Defines the ten-phase workflow, required checks, and the complete tool matrix.
• skills/api-security/references/rest-graphql-testing.md: Contains detailed REST and GraphQL exploitation techniques that flesh out Phases 4 and 5.
• skills/api-security/references/jwt-oauth-testing.md: Provides in-depth JWT and OAuth attack patterns referenced in Phase 2.
• skills/tool-index.md: Maintains an auto-generated inventory of locally available tools (e.g., jwt_tool, api.sh, Vespasian) that the agent must verify before execution.
• README.md: Provides the routing architecture that selects the API-security skill when appropriate.
• RULES.md: Enforces global gating rules ensuring all actions are authorized before execution.

Executable Code Examples

The following commands demonstrate the automated execution of specific methodology phases:

Auto-generate an OpenAPI spec from live traffic (Phase 1):

# Vespasian captures traffic and writes an OpenAPI 3.0 document

vespasian -i http://target/api -o api-spec.yaml

Test JWT for algorithm confusion attacks (Phase 2):

# Replace alg with "none" and remove the signature

jwt_tool -i token.jwt --alg none --no-signature

# Try RS256 → HS256 key reuse attack

jwt_tool -i token.jwt --alg hs256 --key $(cat public.pem)

Run the full discovery-to-authorization pipeline (Phases 1-3):

# One-liner that discovers endpoints, authenticates, then attempts BOLA attacks

api.sh discover -u https://target/api \
    && api.sh auth --jwt-tool \
    && api.sh authorize --burp-authorize

Summary

• The reverse-skill repository implements API security testing as a strict ten-phase workflow defined in skills/api-security/SKILL.md, ensuring no phase is skipped.
• Each phase requires tool verification against skills/tool-index.md and mandates reproducible evidence before progression.
• The methodology covers the full lifecycle: from Vespasian-powered discovery through jwt_tool authentication attacks to StackHawk CI/CD enforcement.
• Supporting reference files in skills/api-security/references/ provide deep technical guidance for REST, GraphQL, JWT, and OAuth testing.
• The RULES.md and routing architecture in README.md ensure all automated actions remain authorized and auditable.

Frequently Asked Questions

What is the API security testing methodology in the reverse-skill repository?

The methodology is a structured, ten-phase workflow defined in skills/api-security/SKILL.md that automates API assessments from discovery to CI/CD integration. It enforces strict sequencing, tool verification via skills/tool-index.md, and evidence collection to eliminate guesswork and ensure auditable results.

Which tools does the methodology require for JWT and OAuth testing?

According to skills/api-security/references/jwt-oauth-testing.md and Phase 2 of the workflow, the primary tools are jwt_tool for JWT algorithm confusion and signature bypass attacks, and Burp Autorize for authorization testing. The agent must verify these tools exist in skills/tool-index.md before execution.

How does the framework prevent unauthorized testing actions?

The repository's RULES.md file implements global gating rules that require explicit authorization before any automated action executes. Additionally, the routing architecture described in README.md ensures the API-security skill only activates under appropriate conditions, preventing accidental or malicious testing.

Can this methodology integrate into existing CI/CD pipelines?

Yes, Phase 10 explicitly addresses CI/CD integration by utilizing Entropy with --ci --watch flags to monitor specification changes, Escape DAST for automated dynamic testing, and StackHawk to enforce build blocks when severe vulnerabilities are detected. This ensures security testing runs automatically during the build process.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}