api-abuse-detection
Skill0 starsChanged 11 days agoMITView on GitHub
Detect and investigate API abuse and data exposure — enumeration/scraping, BOLA exploitation, token misuse, excessive data retrieval, unrestricted business flows — from gateway/WAF/application logs, and scope affected records. Use when an API shows anomalous traffic, a researcher reports an API data leak, or you need detections for OWASP API risks in production.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
API Abuse Detection and Investigation
Log fields you need
Timestamp, client IP, authenticated principal (user ID / client ID / API key ID), tenant, method, route template (/orders/{id}) and concrete path, object IDs, status code, response size, latency, user agent, request ID. Without principal and object ID, BOLA scoping is impossible — fix logging first.
Detection patterns
| Abuse | Signal |
| BOLA enumeration | One principal accessing many distinct object IDs not owned by them; sequential ID walks; high ratio of 403/404 then 200s |
| Scraping | High request rate per principal/IP across list endpoints; many pages; non-browser UAs; rotating IPs with same token |
| Token misuse | Same token from many IPs/ASNs/countries; token used after user offboarding; API key from unexpected networks |
| Excessive data | Response sizes far above baseline for an endpoint; limit=10000 parameters |
| Business-flow abuse (API6) | Mass account creation, coupon redemption, ticket purchase bursts |
| Credential stuffing against auth APIs | credential-stuffing-defense |
Splunk example (BOLA candidate):
index=api route="/api/v2/orders/{id}" status=200 earliest=-24h
| stats dc(object_id) as objects dc(owner_id) as owners by principal_id
| where objects > 200 AND owners > 20 | sort -objectsSentinel (APIM / App Gateway logs, columns depend on diagnostic category):
ApiManagementGatewayLogs
| where TimeGenerated > ago(1d)
| summarize requests=count(), distinctUrls=dcount(Url), avgBytes=avg(ResponseSize) by CallerIpAddress, ApimSubscriptionId
| where distinctUrls > 500Incident scoping
- Identify the vulnerable endpoint and the abusing principals/IPs.
- Enumerate every object returned to those principals (object IDs + response sizes) → affected records and data fields.
- Determine time window (first abusive request to fix deployment) and whether other principals exploited it.
- Hand off to
privacy-incident-assessmentwith counts and data types.
Related skills
api-authorization-testing, waf-rule-tuning, credential-stuffing-defense, data-exposure-investigation
References
- OWASP API Security Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x11-t10/
- OWASP Automated Threats to Web Applications: https://owasp.org/www-project-automated-threats-to-web-applications/
- Azure API Management diagnostics logs: https://learn.microsoft.com/en-us/azure/api-management/monitor-api-management
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.