/probe

API DAST Reference

Purpose: Dynamically attack a running REST, GraphQL, or WebSocket API to confirm OWASP API Security Top 10 2023 flaws with reproducible evidence. Static review (source code, OpenAPI spec lint) is out of scope — cross-link to Sentinel and Gateway for those layers.

Currency note (2026-05):

• OWASP API Top 10 2023 is still the active list — no 2026 update yet (owasp.org/API-Security/). Threat-stat refresh from Wallarm 2026 API ThreatStats Report (2026-02-17): 43% of 2025 CISA KEV additions were API-related (106 / 245), 97% exploitable in a single request, 52% of disclosed API breaches were broken-auth, and 36% of AI vulnerabilities overlap with API vulnerabilities.
• Burp AI (PortSwigger, announced 2025-03-31): AI-generated login-sequence handling, automated issue validation with AI-generated PoCs, AI insights in Repeater. Burp Scanner natively parses OpenAPI, SOAP WSDL, Postman Collection, and GraphQL definitions.
• Akto (open-source, MIT, github.com/akto-api-security/akto): 1,000+ pre-built tests including BOLA / Broken Auth / SSRF / mass assignment; integrates with Burp, AWS, Postman, GCP traffic sources for low-FP discovery. Useful as a complement to Burp Autorize for CI-driven BOLA sweeps.
• MCP-specific attack surface (2025-2026): Wallarm tracked 315 MCP-related vulnerabilities in 2025 with 270% Q2→Q3 growth — when the API exposes an MCP server, test for tool-name shadowing, tool-description injection, and unauthenticated tools/list enumeration.

Scope Boundary

• Probe api: runtime attacks against a deployed API. Confirms exploitability, produces request/response evidence, CVSS v4.0 scores, and remediation SLA.
• Sentinel: static source/config audit — hardcoded secrets, unsafe ORM usage, missing auth decorators. Probe api validates Sentinel findings at runtime.
• Gateway: API design — OpenAPI spec, versioning, breaking-change detection. Probe api attacks the deployed implementation to confirm the spec actually enforces what it claims.
• Breach: full red-team engagement chaining API flaws into business impact. Probe api is the DAST slice inside that engagement.

If the question is "does the spec say X?" → Gateway. "Does the code say X?" → Sentinel. "Does the running API actually enforce X under attack?" → api.

AUTHORIZATION: Written scope authorization is mandatory before any active testing. Passive inspection (schema download, public docs) only, unless the target, environment, and attack classes are explicitly named in a signed scope document. Production active testing requires separate written approval. Unauthorized API testing is illegal regardless of intent.

OWASP API Top 10 2023 Coverage

Tooling

Workflow

PLAN      →  confirm written scope, target list, environments, excluded endpoints
          →  obtain auth artifacts: 2+ identities at different privilege tiers
          →  acquire OpenAPI / GraphQL schema; if unavailable, negotiate discovery budget
          →  declare attack classes in-scope (BOLA? mass assignment? SSRF?)

SCAN      →  passive: schema analysis, introspection (GraphQL), header review
          →  stateful fuzz: restler / schemathesis with 2 identities
          →  BOLA sweep: Autorize or scripted dual-session diff on every object-ID path
          →  BFLA sweep: call role-restricted endpoints with low-privilege token
          →  mass assignment: inject out-of-schema fields (`isAdmin`, `role`, `owner_id`)
          →  GraphQL: introspection exposure, query depth > 10, alias batching, field suggestions
          →  WebSocket: origin check, auth at upgrade, message-level authz, replay

VALIDATE  →  reproduce each finding with minimal curl / HTTPie payload
          →  label Confirmed vs Unconfirmed; FP rate target < 30%
          →  CVSS v4.0 per finding; fall back to v3.1 if tooling limits
          →  cross-check against Sentinel static findings (if provided) for correlation

REPORT    →  per-finding: repro, evidence, CVSS, SLA, remediation
          →  handoff: Builder (fix), Gateway (spec tightening), Sentinel (static rule)

BOLA Testing Pattern

Traditional DAST cannot dynamically substitute credentials — you must configure the tool for two identities.

Identity A (user_a, owns object_id=101)
Identity B (user_b, owns object_id=202)

For every endpoint matching /resource/{id}:
  1. Call as A against A's object → expect 2xx (baseline)
  2. Call as A against B's object → expect 403/404
  3. Call as B against A's object → expect 403/404
  4. Unauthenticated call → expect 401

Any 2xx in steps 2-4 = Confirmed BOLA.

Burp Autorize automates this. ZAP requires Zest scripts or the API Access Control add-on.

GraphQL-Specific Checks

• Introspection on in production → API8 / information disclosure.
• Query depth / alias / batch limit: send { a:user{friends{friends{...}}} } nested ≥ 10 and aliased 100x — if no limit, API4.
• Field-level authz: graphql-cop + manual per-field probe with low-privilege token.
• Batching abuse: [{query:...},{query:...}] x 1000 to bypass rate limits measured per-request.
• Mutations without CSRF / origin checks.

Anti-Patterns

• Running unauthenticated scan only — misses API1, API3, API5 entirely.
• Using one identity for "auth testing" — cannot detect BOLA.
• Accepting "200 OK with empty array" as authz enforcement — often it's silent failure.
• Trusting OpenAPI spec as ground truth — the whole point of api is the implementation drifted from the spec.
• Fuzzing production without isolation — rate-limit the fuzzer (-rl 30 for Nuclei on prod-adjacent).
• Skipping WebSocket auth review — upgrade handshake often trusted blindly post-connect.

Handoff

• → Builder: confirmed finding + minimal repro + remediation pattern + SLA.
• → Gateway: when flaw is spec-level (missing security:, no rate-limit extension, overpermissive CORS) — spec needs tightening.
• → Sentinel: confirmed runtime flaw with probable source location — refine static rules.
• → Triage: any CVSS ≥ 9.0 (auth bypass, mass assignment on admin role, SSRF to cloud metadata).
• → Radar: confirmed pattern → regression test.
• → Vigil: exploit signature → Sigma/YARA detection rule.