api.sh — 8-Phase Deep API Exploitation Scanner

Specialized API security scanner covering GraphQL introspection, REST abuse, WebSocket exploitation, SOAP/XXE, rate limiting bypass, and schema harvesting.

---

Features

8-Phase Pipeline

1. GraphQL Recon — Introspection queries, schema extraction
2. GraphQL Exploit — Field suggestion bruteforce, batching attacks, nested query DoS
3. GraphQL Brute — Mutation/query name enumeration
4. REST Abuse — Method switching, version downgrade (/v1/ vs /v2/)
5. WebSocket — WS endpoint discovery, message injection, auth bypass
6. SOAP/XXE — WSDL disclosure, operation enumeration, XML External Entity
7. Rate Bypass — Header manipulation, IP rotation, slow-rate attacks
8. Schema Harvest — API documentation, swagger/OpenAPI extraction

Quality

• Cross-tool input — Reads findings from access.sh and hunt.sh output
• VRT-ready — Findings pre-categorized
• Resume support — Continue from last phase
• Chaining — Works with hunt.sh findings

---

Requirements

Required

sudo pacman -S curl jq

Recommended

graphql-cli nuclei arjun paramspider

---

Installation

git clone https://github.com/Sharon-Needles/api
cd api

sudo ln -s "$(pwd)/api.sh" /usr/local/bin/api

---

Quick Start

CLI Mode

api --target "Company" --domains scope.txt --platform bugcrowd

On API Endpoints

api --target "Company" -u api_endpoints.txt --platform hackerone

Resume

api --resume ./hunts/Company_API_20260423_120000

---

Usage

Usage: api.sh [OPTIONS]

Options:
  --target NAME           Target name
  --domains FILE          Domains (finds /api endpoints)
  -u, --urls FILE         API URLs directly
  --platform PLATFORM     bugcrowd | hackerone
  --resume PATH           Resume hunt
  -h, --help              Show help

---

Output

Company_API_20260423_*/
├── phase_1_graphql_recon.txt
├── phase_2_graphql_exploit.txt
├── phase_3_graphql_brute.txt
├── phase_4_rest_abuse.txt
├── phase_5_websocket.txt
├── phase_6_soap_xxe.txt
├── phase_7_rate_bypass.txt
├── phase_8_schema_harvest.txt
├── findings.txt
├── [SUBMIT:Px].txt
└── report.md

---

Integration with hunt.sh

# Extract API endpoints from hunt phase 3
cat ./hunts/Target_*/phase_3_sweep.json | jq '.[] | select(.url | contains("/api")) | .url' > api.txt

api --target "Target" -u api.txt --platform bugcrowd

---

Tested On

• BlackArch Linux
• Bash 5.x

---

License

MIT

---

Disclaimer

Use responsibly with explicit permission only.