1|#!/usr/bin/env bash
2|# Vector 14: API Abuse & Security Testing
3|# Desc: Rate limiting, auth bypass, mass assignment, parameter pollution
4|# Detect: API endpoints /api/, /v1/, /rest
5|# Severity: HIGH
6|# Tools: curl
7|
8|vector_apiab() {
 local target="$1"
 local report="$2"
 local findings=0
 
 print_info "Testing API security..."
 
 local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
 local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
 
 # Discover API endpoints
 local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
 local api_urls=$(echo "$page" | perl -nle 'while (/"https?:\/\/[^"]*api[^"]*"|"\/api\/[^"]*"|"\/v[0-9]\/[^"]*"/g) { print \$& }' 2>/dev/null | sort -u | head -10)
 
 for endpoint in $api_urls; do
   endpoint=$(echo "$endpoint" | tr -d '"')
   [[ "$endpoint" == /* ]] && endpoint="${base}${endpoint}"
   
   # Test various auth bypass methods
   local methods=("GET" "POST" "PUT" "DELETE" "PATCH" "OPTIONS")
   
   for method in "${methods[@]}"; do
     local response=$(curl -s --connect-timeout 5 --max-time 10 \
       -X "$method" \
       -H "Authorization: Bearer" \
       -H "Authorization: null" \
       -H "X-Forwarded-For: 127.0.0.1" \
       "$endpoint" 2>/dev/null)
     
     # Check for unexpected access
     local status=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" --connect-timeout 5 --max-time 10 "$endpoint" 2>/dev/null)
     
     if [ "$status" = "200" ] && [ "$method" != "GET" ]; then
       print_warn "Unusual: $method $endpoint returns $status"
     fi
   done
   
   # Test rate limiting
   local rate_check=0
   for i in 1 2 3 4 5 6 7 8 9 10; do
     local rstatus=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 3 --max-time 5 "$endpoint" 2>/dev/null)
     if [ "$rstatus" = "429" ] || [ "$rstatus" = "503" ]; then
       rate_check=$((rate_check + 1))
     fi
   done
   
   if [ "$rate_check" -eq 0 ]; then
     print_warn "No rate limiting detected on $endpoint"
     echo "SEVERITY: MEDIUM
57|VECTOR: Missing Rate Limiting
58|DETAIL: No rate limiting on $endpoint
59|EVIDENCE: 10 rapid requests without 429/503 response
60|EXPLOIT: Enables brute force, credential stuffing, DoS" > "$REPORTS_DIR/.finding_$(date +%s)_ratelimit.txt"
     findings=$((findings + 1))
   fi
 done
 
 return $findings
66|}
67|