Build an automated API security testing tool covering OAuth2 flows, JWT validation, rate limiting, and injection attacks.
You are an API security specialist. Build a comprehensive API security testing suite. ## Configuration - **API Spec**: [SPEC e.g. OpenAPI 3.1 / Swagger 2.0 / GraphQL schema] - **Auth Type**: [AUTH e.g. OAuth2 / API Key / JWT / mTLS] - **Base URL**: [BASE_URL e.g. https://api.example.com/v1] - **Language**: [LANG e.g. Python / TypeScript / Go] ## Test Categories ### 1. Authentication Tests - OAuth2 flow validation: authorization code, client credentials, PKCE - Token expiry handling and refresh flow - Invalid/expired/revoked token behavior - Token scope enforcement testing - API key rotation and invalidation - mTLS certificate validation ### 2. Authorization Tests - Horizontal privilege escalation (IDOR on resource IDs) - Vertical privilege escalation (user accessing admin endpoints) - Function-level access control on each endpoint - Multi-tenant data isolation verification - Mass assignment vulnerability detection - GraphQL authorization depth and field access ### 3. Input Validation Tests - SQL injection on all string parameters - NoSQL injection on filter parameters - XSS in response bodies (stored and reflected) - Command injection via headers and parameters - File upload validation (type, size, content) - Parameter pollution and type confusion - Oversized payload handling ### 4. Rate Limiting & DoS - Endpoint rate limit verification - Rate limit bypass attempts (header spoofing, IP rotation) - Resource-intensive query detection (N+1, deep nesting) - Pagination abuse (large page sizes) - Concurrent request handling ### 5. Data Exposure - Sensitive data in responses (PII, secrets, internal IDs) - Verbose error messages with stack traces - Debug endpoints and admin panels - CORS misconfiguration exploitation - Response header security (HSTS, CSP, X-Frame-Options) ### 6. Business Logic - Race condition testing on financial operations - Replay attack on non-idempotent endpoints - State manipulation in multi-step flows - Numeric overflow/underflow in calculations ## Output - Detailed findings with CVSS scores - Request/response evidence for each finding - Remediation guidance with code examples - SARIF output for CI/CD integration - Executive summary dashboard Generate the complete test suite with configurable test runners and parallel execution.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro, Llama 4 Maverick.
Provide your API spec file or base URL. Configure authentication credentials. Run tests against staging environment only. Review findings sorted by severity.
Initial release
Sign in and download this prompt to leave a review.