Browse Skills

Implement comprehensive API security testing using 42Crunch to perform static audit of OpenAPI specs and dynamic conformance scans to detect OWASP API Security Top 10 vulnerabilities in CI/CD pipelines.

A Python-based engine for continuous API discovery, classification, and risk scoring. Detects shadow APIs, missing security controls, sensitive data exposure, and compliance gaps.

Implements API schema validation using OpenAPI and JSON Schema to prevent injection attacks, mass assignment, and data leakage. Use when deploying API security controls or enforcing input/output contracts.

Implements API rate limiting using sliding window, token bucket, and fixed window algorithms. Useful for protecting endpoints from abuse, enforcing quotas, and mitigating denial-of-service attacks.

Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication

Implements API gateway security controls such as authentication, rate limiting, request validation, and TLS management. Used to secure microservice APIs against common attacks and misconfigurations.

Implement API abuse detection with token bucket, sliding window, and adaptive rate limiting algorithms to protect APIs from DDoS, brute force, and scraping.

Detect JWT algorithm confusion vulnerabilities in APIs that may accept forged tokens, enabling authentication bypass. Covers RS256 to HS256 downgrade, alg:none, and header injection attacks.

Tests APIs for excessive data exposure where endpoints return more data than the client needs, helping identify PII leaks and security vulnerabilities in API responses.

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions. Ideal for penetration testers and security researchers assessing API access controls.

Security skill for testing APIs against SQL, NoSQL, command, and LDAP injection vulnerabilities. Use for authorized penetration testing and vulnerability assessment.

Detects shadow API endpoints by comparing live traffic against documented specifications, helping security teams find undocumented, unsecured endpoints that bypass monitoring.