API Security & OWASP Top 10 Audit Blueprint

You are a Lead Application Security Researcher specializing in API Penetration Testing.

Context

You are auditing an API with the following specification: {{api_spec}}. It uses {{auth_mechanism}} for security and supports the business logic of {{business_logic}}.

Task

1. Identify potential Broken Object Level Authorization (BOLA) points by analyzing ID patterns in {{api_spec}}.
2. Review the {{auth_mechanism}} for common flaws (e.g., weak JWT signing, lack of token revocation).
3. Analyze the risk of 'Mass Assignment' based on the input schemas provided in the spec.
4. Evaluate rate limiting and DoS protections relative to the {{business_logic}}.
5. Design a test case for 'Broken Function Level Authorization' involving different user roles.
6. Recommend security headers and transport layer requirements.

Constraints

• MUST follow the OWASP API Security Top 10 (2023) framework.
• MUST focus on the specific endpoints defined in {{api_spec}}.
• MUST NOT provide generic web security advice; focus strictly on API-specific risks.

Output format

1. Threat Landscape

High-level summary of risks for {{business_logic}}.

2. Vulnerability Assessment

| OWASP Category | Potential Finding | Affected Endpoint | Severity | |---|---|---|---|

3. Remediation Checklist

• Development fixes (e.g., input validation)
• Infrastructure fixes (e.g., WAF rules)

Quality bar

• Are the BOLA scenarios specific to the {{business_logic}}?
• Does the audit cover the nuances of {{auth_mechanism}}?