Authorized, safe-by-default HTTP/API testing. Read ../../SECURITY_RULES.md first. Conservative rates; owned/staging targets; read-only unless a write is explicitly authorized against a disposable record.
Deliverables
- Route inventory
- Endpoint Risk Matrix (
../../templates/endpoint-risk-matrix.md) - Confirmed / Suspected Findings, Passed Checks
- Fix plan + regression tests
Phases
- Scope & authorization.
- Route discovery — from OpenAPI/Swagger, JS bundles,
run-httpx.sh,run-ffuf-safe.sh(owned/staging only), sitemap, robots. - Spec leakage — is OpenAPI/Swagger/GraphQL introspection public? Does it leak internal routes?
- AuthN — token validation negative tests (deny expected).
- AuthZ — IDOR/BOLA (object level) + broken function-level authorization (admin routes as normal user).
- Mass assignment — extra fields (
is_admin,role,owner_id) accepted? - Excessive data exposure — responses leaking fields the UI hides.
- SSRF — URL/webhook/import params;
../../payloads/ssrf.txt. - Injection — SQL/NoSQL/command/template, safe probes only.
- File upload — type/size/content-type validation; path of stored file.
- Webhook signature bypass — missing/forged/replayed signatures.
- CORS — wildcard + credentials; reflected origin.
- CSRF — where cookies authenticate state-changing routes.
- Rate limiting & pagination abuse — realistic abuse, low volume.
- Cache poisoning — unkeyed headers influencing cached responses.
- Error/debug leakage — stack traces, debug endpoints, health endpoints leaking versions/config, admin endpoints exposed.
- Request size / timeout — limits enforced.
- Sensitive-data logging — tokens/PII in logs.
Full checklist
endpoint-checklist.md. Payloads: payload-catalog.md +
../../payloads/.
Report
report-template.md or hand to security-report-writer.