Pentest API Attacker

该 Skill 在授权范围内枚举并测试 API 端点，覆盖发现、认证滥用及协议相关检查，输出标准化的端点、漏洞发现和攻击报告 JSON。运行前需校验范围，支持 dry-run，实时测试需显式授权参数，并将结果导出供下游 Skill 使用。

0x-professor

热度 79.72

最近更新 2026-05-11 17:27:54

分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：API 集成 / 报告撰写 / 自动化脚本 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pentest-api-attacker

Metadata

name: pentest-api-attacker
description: Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.

Pentest API Attacker

Stage

PTES: 5
MITRE: T1190

Objective

Enumerate and test API endpoints and business logic attack vectors.

Required Workflow

Validate scope before any active action and reject out-of-scope targets.
Run only authorized checks aligned to PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK.
Write findings in canonical finding_schema format with reproducible PoC notes.
Honor dry-run mode and require explicit --i-have-authorization for live execution.
Export deterministic artifacts for downstream skill consumption.

Execution

python skills/pentest-api-attacker/scripts/api_attacker.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run

Outputs

api-endpoints.json
api-findings.json
api-attack-report.json

References

references/tools.md
skills/autonomous-pentester/shared/scope_schema.json
skills/autonomous-pentester/shared/finding_schema.json

Legal and Ethical Notice

WARNING AUTHORIZED USE ONLY
This skill executes real security testing tools against live targets.
Use only with written authorization.