07. References & Testing Tools

This chapter provides an organized reference catalog of official security standards, open-source auditing tools, automated SAST/DAST rulesets, and notable CVE case studies for API security engineers and penetration testers.

---

1. Official Standards & Technical Specifications

• OWASP API Security Top 10 (2023) — Official OWASP framework categorizing top API security risks.
• OpenAPI Specification v3.1.0 — The standard machine-readable interface description format for RESTful APIs.
• NIST SP 800-204: Security Strategies for Microservices Architecture — National Institute of Standards and Technology guidance on microservice & API security.
• RFC 7519: JSON Web Token (JWT) — IETF standard specification for compact claims representation.
• RFC 7636: Proof Key for Code Exchange (PKCE) — Extension to OAuth 2.0 for public clients to prevent code interception.
• RFC 6749: The OAuth 2.0 Authorization Framework — Industry standard protocol for authorization.

---

2. API Security Testing & Discovery Toolchain

Tool	Category	Primary Function & Usage Command
Nuclei	DAST / Vulnerability Scanner	Fast template-based vulnerability scanner for API misconfigurations & CVEs. nuclei -u https://api.target.local -t http/vulnerabilities/
Kiterunner	API Discovery	Context-aware API route and parameter discovery engine. kr scan https://api.target.local -w routes-large.kite
Schemathesis	Property-Based Contract Testing	Property-based API testing tool that reads OpenAPI specs to generate malformed payloads. schemathesis run https://api.target.local/openapi.json
GraphQLmap	GraphQL Audit	CLI engine for auditing and exploiting GraphQL endpoints. python graphqlmap.py -u https://target.local/graphql
Astra	Automated API Scanner	Automated security testing framework for REST APIs integrated into CI/CD pipelines.
OWASP ZAP API Scan	DAST Scanner	Dynamic scanner configured for OpenAPI/GraphQL endpoints. zap-api-scan.py -t https://api.target.local/openapi.json -f openapi
Spectral	OpenAPI Linter	Static linter for OpenAPI/AsyncAPI specifications enforcing security rules.

---

3. Automated SAST Rulesets (Semgrep Rules)

Static Application Security Testing (SAST) rules can catch BOLA, BFLA, and Mass Assignment flaws during code review.

Semgrep Rule: BOLA Detection (Missing User Filter in Query)

rules:
  - id: python-flask-possible-bola
    patterns:
      - pattern: `$MODEL.query.get($`ID)
      - pattern-not-inside: |
          $MODEL.query.filter_by(..., user_id=..., ...)
    message: "Potential BOLA: Database object fetched using raw ID parameter without explicit user_id filter."
    severity: WARNING
    languages: [python]

Semgrep Rule: JWT alg: none or Missing Algorithm Enforcement

rules:
  - id: nodejs-jwt-missing-algorithm-restriction
    patterns:
      - pattern: jwt.verify(`$TOKEN, $`SECRET)
      - pattern-not: jwt.verify(`$TOKEN, $`SECRET, { algorithms: [...] })
    message: "JWT verification lacks explicit algorithm allowlist, making it vulnerable to alg:none or HS256/RS256 key confusion."
    severity: ERROR
    languages: [javascript, typescript]

---

4. Notable Real-World API CVE Case Studies

CVE-2022-22965 (Spring4Shell)

• Vulnerability Class: Mass Assignment / Data Binding RCE (OWASP API3:2023).
• Mechanism: Spring Framework's data binder allowed HTTP parameters to bind to class properties (class.module.classLoader...). Attackers manipulated the Tomcat logging properties via parameter binding to write an arbitrary JSP web shell to disk.
• Remediation: Allowlisting allowed properties or upgrading Spring Framework.

CVE-2023-30845 (Apollo Server DoS)

• Vulnerability Class: Unrestricted Resource Consumption (OWASP API4:2023).
• Mechanism: Apollo Server versions prior to v4.7.1 allowed memory exhaustion when parsing recursive inline fragments in GraphQL queries.
• Remediation: Upgrade Apollo Server and enforce MaxTokensLimiter / graphql-depth-limit.

CVE-2023-44487 (HTTP/2 Rapid Reset)

• Vulnerability Class: Infrastructure DoS affecting gRPC / HTTP/2 servers.
• Mechanism: Adversaries abused HTTP/2 multiplexing by generating opening streams (HEADERS) and instantly canceling them (RST_STREAM) in rapid bursts, causing high CPU allocation on gRPC reverse proxies.
• Remediation: Configure MAX_CONCURRENT_STREAMS and apply patch updates to Envoy, Nginx, and gRPC runtimes.

---

Return to Module Overview & Index →