API Tests
Index¶
Access Control¶
- Authenticated route bypass
- Broken Object Level Authorization
- Forced Browsing
- Private data
- Private fields
- Public state-altering operation
- Sensitive endpoint bruteforce
- Tenant isolation
Configuration¶
- Directory listing
- DNS record DKIM
- DNS record DMARC
- DNS record loopback
- DNS record permissive SPF
- DNS record private IP
- DNS record TXT length
- DNS record TXT sensitive
- DNSSEC not enabled
- Error type inconsistency
- GraphQL Automatic Persisted Queries
- GraphQL Extension Disclosure
- GraphQL IDE
- Springboot Actuator Restart Misconfiguration
- Springboot Actuator Shutdown Misconfiguration
- Configuration_SubresourceIntegrityMissing
- Unhandled endpoint
- WAF Bypass
Information Disclosure¶
- Agentic issue
- Airflow Config Exposure
- Alibaba Canal Leak
- Ansible Config Exposure
- Appspec Exposure
- AppVeyor Config Exposure
- AWS access token exposed
- AWS Config Exposure
- AWS Docker Config Exposure
- AWStats Config Exposure
- AWStats Exposure
- Azure Tenant ID Exposure
- Source code disclosure
- Debug mode
- Exposed MySQL Config
- Exposed settings.php
- Exposed SQL Dumps
- File disclosure
- GraphQL Field Suggestion
- Introspection enabled
- Possible User Enumeration
- Nuclei Issue
- Port Remediation
- Vulnerable Package
- Private IP
- Field Suggestion
- Software Component Leak
- Springboot Actuator Disclosure of Thread Dump
- Springboot Actuator Disclosure of Environment
- Springboot Actuator Disclosure of Heap Dump
- Springboot Actuator Disclosure of Logfile
- Springboot Actuator Disclosure of Mappings
- Springboot Actuator Disclosure of Trace
- Stacktrace
- WordPress oEmbed Endpoint Exposure
- WordPress RDF Feed Users Exposed
- WordPress REST API Users Exposed
- WordPress wp-cron Exposed
- WordPress xmlrpc.php Exposed
Injection¶
- Arbitrary Token Scope Injection
- Command Injection
- CRLF Injection
- Deserialization Attack
- Directory traversal
- File inclusion
- Improper Input Validation Injection
- Stored Improper Input Validation Injection
- JWT algorithm confusion
- JWT no algorithm
- JWT Signature check
- LLM Endpoint Detection
- LLM Excessive Agency
- LLM Insecure Output Handling
- LLM Insecure Plugin Design
- LLM JailBreak
- LLM Model Denial of Service
- LLM Model Theft
- LLM Overreliance
- LLM Prompt Injection
- LLM Sensitive Information Disclosure
- LLM Supply Chain Vulnerabilities
- LLM Training Data Poisoning
- Log4Shell
- Mass Assignment
- NoSQL Injection
- NoSQL Injection Stored
- SQL Injection
- SSTI (Server-Side Template Injection)
- XXE Injection
Protocol¶
- CORS
- GraphQL Content Type
- Access-Control-Allow-Origin Header
- Cache Control Header
- Content Security Policy Header
- Content-Type header
- Header leak
- Cookie Security
- Strict Transport Security
- X-Content-Type-Options
- X-Frame-Options header
- Headers
- Request smuggling
- Server Error
- SSL enforced
- SSL Certificate
- TLS Configuration Ciphers
- TLS Protocol Configuration
- TLS Configuration
- TLS Configuration Server Defaults
- TLS Configuration Server Preferences
- TLS vulnerabilities
Request Forgery¶
- GET based CSRF
- POST based CSRF
- Open redirection Forgery
- Server Side Request Forgery
- SSRF Injection in headers
Resource Limitation¶
- Character limit
- Cyclic query
- GraphQL Alias Limit
- GraphQL Batch Limit
- GraphQL Cyclic Recursive Query
- GraphQL Depth Limit
- GraphQL Directive Overloading
- GraphQL Field Duplication
- GraphQL Field Limit
- GraphQL Recursive Fragment
- GraphQL Width Limit
- Large JSON input
- Pagination missing
- Resource limiting bypass
- Response size
- Security timeout
- Unreachable server
Schema¶
- Duplicate Query/Mutation Name
- Duplicated object
- Response Format
- Invalid condition in allOf
- Invalid parameters in path
- Invalid Persisted Query
- Invalid references
- Mismatching persisted queries and schema
- Permissive JSON Input
- Positive integer validation
- GraphQL Response Type Mismatch
- Swagger rules
- Typing misconfiguration
- Undefined objects
- Zombie object