EH-28: API Security Assessment - REST API Pentest

echo "=== API Assessment Checklist ==*"
echo ""

echo "1. Discovery"
echo "   curl http://target/api/"
echo "   curl http://target/swagger.json"
echo "   curl http://target/api/v1/users"
echo "   curl http://target/api/v2/users"
echo ""

echo "2. Authentication"
echo "   curl -X POST http://target/api/login -d '{\"user\":\"admin\",\"pass\":\"admin\"}'"
echo "   curl http://target/api/admin -H 'Authorization: Bearer none'"
echo ""

echo "3. Authorization (IDOR)"
echo "   curl http://target/api/user/1"
echo "   curl http://target/api/user/2  # test IDOR!"
echo ""

echo "4. Injection"
echo "   curl 'http://target/api/search?q=test'"
echo "   curl 'http://target/api/search?q=test' OR '1'='1"
echo ""

echo "5. Rate Limiting"
echo "   for i in {1..100}; do curl http://target/api/login -d '{\"pass\":\"test\"}' & done"
echo ""

echo "6. CORS"
echo "   curl -H 'Origin: https://evil.com' http://target/api/data"
echo ""

echo "7. Sensitive Data"
echo "   curl http://target/api/users | jq '.[] | {username, password, email}'"
echo ""

echo "=== FINDINGS ==*"
echo "  [HIGH] IDOR - /api/user/2 mengembalikan data user lain"
echo "  [MED] No rate limiting - brute force unlimited"
echo "  [LOW] CORS - origin di-reflect"