open-sploit 1.2.0

package/template/skills/conducting-api-security-testing/LICENSE

@@ -0,0 +1,201 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please do not remove or change
+      the license header comment from a contributed file except when
+      necessary.
+
+   Copyright 2026 mukul975
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/template/skills/conducting-api-security-testing/SKILL.md

@@ -0,0 +1,195 @@
+---
+name: conducting-api-security-testing
+description: 'Conducts security testing of REST, GraphQL, and gRPC APIs to identify
+  vulnerabilities in authentication, authorization, rate limiting, input validation,
+  and business logic. The tester uses the OWASP API Security Top 10 as the testing
+  framework, combining Burp Suite interception with Postman collections and custom
+  scripts to test endpoint security at every privilege level. Activates for requests
+  involving API security testing, REST API pentest, GraphQL security assessment, or
+  API vulnerability testing.
+
+  '
+domain: cybersecurity
+subdomain: penetration-testing
+tags:
+- API-security
+- OWASP-API-Top10
+- REST
+- GraphQL
+- authorization-testing
+version: 1.0.0
+author: mahipal
+license: Apache-2.0
+nist_csf:
+- ID.RA-01
+- ID.RA-06
+- GV.OV-02
+- DE.AE-07
+mitre_attack:
+- T1190
+- T1213
+- T1552.001
+- T1078
+- T1071.001
+---
+# Conducting API Security Testing
+
+## When to Use
+
+- Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses
+- Assessing the security of microservices architecture where APIs are the primary communication method
+- Validating that API gateway protections (rate limiting, authentication, input validation) are properly enforced
+- Testing third-party API integrations for data exposure and insecure configurations
+- Evaluating GraphQL APIs for introspection disclosure, query complexity attacks, and authorization bypasses
+
+**Do not use** against APIs without written authorization, for load testing or denial-of-service testing unless explicitly scoped, or for testing production APIs that process real financial transactions without safeguards.
+
+## Prerequisites
+
+- API documentation (OpenAPI/Swagger, GraphQL schema, Postman collection) or application access to reverse-engineer the API
+- Burp Suite Professional configured to intercept API traffic with JSON/XML content type handling
+- Postman or Insomnia for organizing and replaying API requests across different authentication contexts
+- Valid API tokens or credentials at multiple privilege levels (unauthenticated, standard user, admin)
+- Target API base URL and version information
+
+## Workflow
+
+### Step 1: API Discovery and Documentation
+
+Map the complete API attack surface:
+
+- **Import API documentation**: Load OpenAPI/Swagger specs into Postman or Burp Suite to catalog all endpoints, methods, parameters, and authentication requirements
+- **Reverse-engineer undocumented APIs**: Proxy the mobile app or web frontend through Burp Suite and exercise all features to capture API calls. Export the Burp sitemap as the baseline endpoint inventory.
+- **GraphQL introspection**: Send an introspection query to discover the full schema:
+  ```json
+  {"query": "{__schema{types{name,fields{name,args{name,type{name}}}}}}"}
+  ```
+- **Endpoint enumeration**: Fuzz for hidden API versions (`/api/v1/`, `/api/v2/`, `/api/internal/`), debug endpoints (`/api/debug`, `/api/health`, `/api/metrics`), and administrative endpoints
+- **Document authentication mechanisms**: Identify if the API uses API keys, OAuth 2.0 Bearer tokens, JWT, session cookies, or mutual TLS
+
+### Step 2: Authentication and Token Testing
+
+Test authentication mechanisms for weaknesses:
+
+- **JWT analysis**: Decode the JWT and inspect claims (sub, exp, iss, aud, role). Test:
+  - Algorithm confusion: Change `alg` to `none` and remove the signature
+  - Key confusion: Change `alg` from RS256 to HS256 and sign with the public key
+  - Weak secret: Brute-force the HMAC secret with `hashcat -m 16500 jwt.txt wordlist.txt`
+  - Token expiration: Verify tokens expire and cannot be used after expiration
+  - Claim tampering: Modify role, userId, or permission claims and re-sign
+- **OAuth 2.0 testing**: Check for redirect_uri manipulation, authorization code reuse, token leakage in Referer headers, and missing state parameter (CSRF)
+- **API key security**: Test if API keys are validated per-endpoint, if revoked keys are immediately rejected, and if keys in query strings appear in access logs or analytics
+
+### Step 3: Authorization Testing (BOLA/BFLA)
+
+Test for Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA):
+
+- **BOLA (IDOR) testing**: For every endpoint that returns user-specific data, replace the object identifier with another user's identifier:
+  - `GET /api/users/123/orders` -> `GET /api/users/456/orders`
+  - Test with numeric IDs, UUIDs, usernames, and email addresses
+  - Automate with Burp Autorize extension: configure it with two sessions (attacker and victim) and replay all requests
+- **BFLA testing**: Using a low-privilege token, attempt to access administrative endpoints:
+  - `DELETE /api/users/456` (admin-only delete)
+  - `PUT /api/users/456/role` (role modification)
+  - `GET /api/admin/dashboard` (admin panel data)
+- **Mass assignment**: Send additional JSON properties not shown in the documentation:
+  ```json
+  PUT /api/users/123
+  {"name": "Test", "role": "admin", "isVerified": true, "balance": 99999}
+  ```
+- **HTTP method testing**: If GET works on an endpoint, try PUT, PATCH, DELETE, and OPTIONS to discover unprotected methods
+
+### Step 4: Input Validation and Injection Testing
+
+Test API inputs for injection and validation flaws:
+
+- **SQL injection in API parameters**: Test all parameters (path, query, body, headers) with SQL injection payloads. JSON APIs are often overlooked: `{"username": "admin' OR 1=1--", "password": "test"}`
+- **NoSQL injection**: For MongoDB backends, test with operator injection: `{"username": {"$gt": ""}, "password": {"$gt": ""}}`
+- **SSRF via API**: Test any parameter that accepts URLs (webhook URLs, avatar URLs, import endpoints) with internal addresses and cloud metadata endpoints
+- **GraphQL-specific injection**: Test for query depth attacks, alias-based batching for brute force, and field suggestion enumeration
+- **XXE in XML APIs**: Submit XML content with external entity declarations to API endpoints that accept XML
+- **Rate limiting validation**: Send 100+ rapid requests to authentication endpoints, password reset, and OTP verification to test for brute force protection
+
+### Step 5: Data Exposure and Response Analysis
+
+Check for excessive data exposure in API responses:
+
+- **Verbose responses**: Compare the data returned in API responses with what the UI displays. APIs often return more fields than needed (internal IDs, creation timestamps, email addresses of other users, role information).
+- **Error message analysis**: Trigger errors by sending malformed input, invalid tokens, and non-existent resources. Check if error messages reveal stack traces, database queries, internal paths, or technology details.
+- **Pagination and enumeration**: Test if enumeration is possible by iterating through paginated responses (`/api/users?page=1`, `page=2`, etc.) to extract all records
+- **GraphQL data exposure**: Query for fields not intended for the current user's role. Test nested queries that traverse relationships to access unauthorized data.
+- **Debug endpoints**: Check `/api/debug`, `/api/status`, `/metrics`, `/health`, `/.env`, `/api/swagger.json` for exposed internal information
+
+## Key Concepts
+
+| Term | Definition |
+|------|------------|
+| **BOLA** | Broken Object Level Authorization (OWASP API #1); failure to verify that the requesting user is authorized to access a specific object, enabling IDOR attacks |
+| **BFLA** | Broken Function Level Authorization (OWASP API #5); failure to restrict administrative or privileged API functions from being accessed by lower-privilege users |
+| **Mass Assignment** | A vulnerability where the API binds client-provided data to internal object properties without filtering, allowing attackers to modify fields they should not have access to |
+| **GraphQL Introspection** | A built-in GraphQL feature that exposes the complete API schema including all types, fields, and relationships; should be disabled in production |
+| **JWT** | JSON Web Token; a self-contained token format used for API authentication containing claims signed with a secret or key pair |
+| **Rate Limiting** | Controls that restrict the number of API requests a client can make within a time window, preventing brute force, enumeration, and abuse |
+
+## Tools & Systems
+
+- **Burp Suite Professional**: HTTP proxy for intercepting, modifying, and replaying API requests with extensions like Autorize for automated authorization testing
+- **Postman**: API development platform used for organizing endpoint collections, scripting tests, and comparing responses across authentication contexts
+- **GraphQL Voyager**: Visual tool for exploring GraphQL schemas obtained through introspection queries
+- **jwt.io / jwt_tool**: Tools for decoding, analyzing, and tampering with JWT tokens to test authentication bypasses
+- **Nuclei**: Template-based scanner with API-specific templates for detecting common misconfigurations and known vulnerabilities
+
+## Common Scenarios
+
+### Scenario: API Security Assessment for a Fintech Mobile Application
+
+**Context**: A fintech startup has a mobile banking application with a REST API backend. The API handles account management, fund transfers, bill payments, and transaction history. The tester has Swagger documentation and accounts at user and admin levels.
+
+**Approach**:
+1. Import Swagger spec into Postman, generating 87 endpoint collections across 12 controllers
+2. Discover BOLA on `/api/v1/accounts/{accountId}/transactions` allowing any authenticated user to view any account's transaction history
+3. Find mass assignment on the user update endpoint where adding `"dailyTransferLimit": 999999` bypasses the configured transfer limit
+4. Identify that the fund transfer endpoint lacks rate limiting, allowing unlimited transfer attempts without throttling
+5. Discover that JWT tokens have a 30-day expiration with no refresh token rotation, enabling long-lived session hijacking
+6. Find that the admin endpoint `/api/v1/admin/users` is accessible with a standard user token (BFLA)
+7. Report all findings with CVSS scores and specific API code-level remediation guidance
+
+**Pitfalls**:
+- Testing only the endpoints documented in Swagger and missing undocumented or deprecated API versions
+- Not testing the same endpoint with tokens from every privilege level to detect authorization bypasses
+- Ignoring response body analysis for excessive data exposure when the UI only shows a subset of returned fields
+- Failing to test for mass assignment by only sending fields shown in the documentation
+
+## Output Format
+
+```
+## Finding: Broken Object Level Authorization in Transaction History API
+
+**ID**: API-001
+**Severity**: Critical (CVSS 9.1)
+**Affected Endpoint**: GET /api/v1/accounts/{accountId}/transactions
+**OWASP API Category**: API1:2023 - Broken Object Level Authorization
+
+**Description**:
+The transaction history endpoint returns all transactions for the specified
+account without verifying that the authenticated user owns the account. Any
+authenticated user can view the complete transaction history of any account
+by substituting the accountId path parameter.
+
+**Proof of Concept**:
+1. Authenticate as User A (account ID: ACC-10045)
+2. Request: GET /api/v1/accounts/ACC-10046/transactions
+   Authorization: Bearer <User_A_token>
+3. Response: 200 OK with User B's full transaction history
+
+**Impact**:
+Any authenticated user can view the complete financial transaction history of
+all 45,000 customer accounts, including amounts, dates, recipients, and
+transaction descriptions.
+
+**Remediation**:
+Implement server-side authorization check that verifies the authenticated user
+owns the requested account before returning data:
+  const account = await Account.findById(accountId);
+  if (account.userId !== req.user.id) return res.status(403).json({error: "Forbidden"});
+```

package/template/skills/conducting-api-security-testing/references/api-reference.md

@@ -0,0 +1,62 @@
+# API Reference: API Security Testing Agent
+
+## Overview
+
+Tests REST and GraphQL APIs for OWASP API Security Top 10 vulnerabilities including BOLA, BFLA, mass assignment, rate limiting, JWT bypass, and GraphQL introspection disclosure. For authorized penetration testing only.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| requests | >=2.28 | HTTP requests to target APIs |
+
+## CLI Usage
+
+```bash
+python agent.py --base-url https://api.target.com --token <jwt> \
+  --low-priv-token <jwt> --graphql --output report.json
+```
+
+## Arguments
+
+| Argument | Required | Description |
+|----------|----------|-------------|
+| `--base-url` | Yes | Target API base URL |
+| `--token` | No | Auth bearer token for authenticated testing |
+| `--low-priv-token` | No | Low-privilege token for BFLA testing |
+| `--login-endpoint` | No | Login endpoint for rate limiting test (default: `/api/auth/login`) |
+| `--graphql` | No | Test GraphQL introspection disclosure |
+| `--output` | No | Output file (default: `api_security_report.json`) |
+
+## Key Functions
+
+### `test_bola(base_url, endpoint_template, id_field, valid_id, other_id, auth_token)`
+Tests Broken Object Level Authorization by accessing another user's resource with own credentials.
+
+### `test_bfla(base_url, admin_endpoints, low_priv_token)`
+Tests admin endpoints with low-privilege tokens using GET, POST, DELETE methods.
+
+### `test_mass_assignment(base_url, endpoint, auth_token, extra_fields)`
+Sends undocumented fields (role, isAdmin) to update endpoints and verifies if they persist.
+
+### `test_rate_limiting(base_url, endpoint, num_requests)`
+Sends rapid requests to detect absence of rate limiting on authentication endpoints.
+
+### `test_jwt_none_algorithm(base_url, endpoint, jwt_token)`
+Forges JWT with `alg: none` to test for algorithm confusion vulnerabilities.
+
+### `test_graphql_introspection(base_url, graphql_endpoint)`
+Sends introspection query to check if full schema disclosure is enabled.
+
+### `test_excessive_data_exposure(base_url, endpoint, auth_token, expected_fields)`
+Compares API response fields against expected fields to identify over-exposure.
+
+## OWASP API Top 10 Coverage
+
+| OWASP ID | Vulnerability | Function |
+|----------|--------------|----------|
+| API1:2023 | Broken Object Level Authorization | `test_bola` |
+| API3:2023 | Excessive Data Exposure | `test_excessive_data_exposure` |
+| API4:2023 | Unrestricted Resource Consumption | `test_rate_limiting` |
+| API5:2023 | Broken Function Level Authorization | `test_bfla` |
+| API6:2023 | Mass Assignment | `test_mass_assignment` |