API认证攻击

NoorQureshi2026-10-25查看 1330复制 1950

> 突破API身份验证：令牌处理、密钥泄露、弱会话/JWT以及无认证端点。使用API密钥、Bearer令牌、HMAC签名或基本认证对REST/GraphQL API进行加载。信号：`Authorization`头、api_key参数、URL中的令牌、/v1与/v2认证漂移。

Download (.md)

📘如何使用这个技能

1
复制技能内容·点击上方「Copy SKILL.md」复制全部内容，或 Download 下载到本地
2
打开你的 AI 客户端·支持 Claude Code、Trae、Cursor、ChatGPT、DeepSeek、Kimi 等任意 AI 助手
3
粘贴为系统提示/知识文件·Claude Code：放入 .claude/skills/ 目录；普通对话：作为首条消息发送并说「请严格按这份技能文档执行」
4
直接提出你的需求·AI 会按技能定义的工作流、格式和约束来处理，无需再解释背景

💡 提示：技能生效后，每次对话只需一句需求，AI 会按 SKILL.md 的流程执行。

SKILL.md2195 chars

---
name: api-auth-attacks
description: >
  Break API authentication: token handling, key leakage, weak session/JWT, and no-auth
  endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic
  auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.
domain: api
type: technique
stability: learning
modes: [bugbounty]
severity: high
owasp_api: [API2:2023-Broken-Authentication]
cwe: [CWE-287, CWE-306]
tools: [burp, jwt_tool]
schema_version: 1
---

# API authentication attacks

## When it applies
An API authenticates requests via tokens/keys/sessions. Auth is the gate; weaknesses here open
everything behind it.

## Why it works
APIs sprawl (many endpoints, versions, clients) so authentication is applied inconsistently:
some routes forgot it, tokens are long-lived or weakly signed, keys leak client-side, and
error/timing differences enable enumeration and brute force.

## Method
1. **No-auth endpoints**: replay requests with the token removed; probe `/v1` vs `/v2`,
   `/internal`, `/debug`, and undocumented routes (Swagger/OpenAPI) for missing auth.
2. **Token weaknesses**: JWT issues (→ `web-auth-jwt`: alg confusion, weak secret, none); long/
   non-expiring tokens; predictable session ids; token accepted in URL (logged/leaked).
3. **Key leakage**: hunt keys in JS bundles, mobile apps, git (→ `code-review-secrets-detection`),
   and test their privilege/scope.
4. **Brute/enumeration**: username enumeration via login/reset differences; weak rate limits on
   login/OTP (→ `web-race-conditions` for OTP windows).
5. **Auth logic**: password reset token predictability/leak, 2FA bypass, "remember me" tokens.

## Gotchas
- Test every version and verb — the fix may exist only on the newest route.
- A leaked key must be *live and privileged* to matter — validate scope, don't over-collect.
- Rate-limit "bypass" via parallelism or header rotation is reportable on many programs.

## Verify success
Authenticated access without valid credentials (no-auth route, forged/replayed token, or a live
leaked key performing a privileged action).

## References
OWASP API Security Top 10 (API2); PortSwigger auth labs.

来源：skillsdirectory

API认证攻击

📘如何使用这个技能

评论0