# API Security Misconfiguration

Offensive testing for API security misconfigurations including verbose errors, debug...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-security-misconfiguration -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-security-misconfiguration -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-security-misconfiguration -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-security-misconfiguration -g -a gemini-cli -y`

## Description

Offensive testing for API security misconfigurations including verbose errors, debug endpoints, dangerous methods, CORS, and exposed management interfaces

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Security Misconfiguration (OWASP API8)

## Purpose
Test for API-level misconfigurations that expose attack surface, leak information, or enable unauthorized access.

## Preconditions
- A mapped API surface
- No requirement for authentication bypass (this tests the CONFIG, not the auth)

## Attack Surface Signals
- Verbose error messages in API responses
- Stack traces or framework debug pages
- HTTP 405 responses listing allowed methods
- CORS headers in responses
- OPTIONS/TRACE methods enabled
- Management/monitoring endpoints accessible

## Methodology

### Verbose Error Testing
```bash
# Send malformed requests, look for stack traces, SQL errors, internal paths
curl -sk "https://TARGET/api/nonexistent" | jq .
curl -sk -X POST "https://TARGET/api/users" -H "Content-Type: application/json" -d 'invalid'
curl -sk "https://TARGET/api/users?id=' OR 1=1--" | jq .
curl -sk -H "Content-Type: application/xml" -d '<root>' "https://TARGET/api/users" | head -20
```

Look for: framework names, versions, file paths, database errors, internal hostnames, stack traces.

### Debug/Admin Endpoint Discovery
```bash
for path in debug status health metrics actuator actuator/env actuator/heapdump \
  _debug __debug admin console management swagger api-docs v1/api-docs \
  graphql playground graphiql redoc api-docs/swagger.json .env config settings; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET/$path")
  [ "$code" != "404" ] && [ "$code" != "000" ] && echo "[$code] /$path"
done
```

### Dangerous HTTP Methods
```bash
# Check which methods are allowed
curl -sk -X OPTIONS -i "https://TARGET/api/users" | grep -i allow

# Try dangerous methods on endpoints that should only accept GET/POST
for method in PUT DELETE PATCH TRACE TRACK; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -X $method "https://TARGET/api/users")
  [ "$code" != "405" ] && [ "$code" != "404" ] && echo "[$method] $code"
done
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-security-misconfiguration/SKILL.md