🎯 Usage Examples¶

# Simple directory fuzzing
python apileaks.py dir --target https://api.example.com

# With custom wordlist
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt

# With WAF evasion and status filtering
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --user-agent-random \
  --status-code 200-299,401,403

# With custom user agent and multiple methods
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --user-agent-custom "Mozilla/5.0 (Custom Security Scanner)" \
  --methods GET,POST,PUT,DELETE \
  --rate-limit 15

# With user agent rotation and error focus
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --user-agent-file wordlists/user_agents.txt \
  --status-code 500-599 \
  --output error_focused_scan

# With framework detection
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --detect-framework \
  --fuzz-versions \
  --user-agent-random \
  --output comprehensive_discovery

# Shallow + fast: a quick, single-level sweep (no recursion)
python apileaks.py dir \
  --target https://api.example.com \
  --depth 1

# Disable recursion entirely (depth-0 pass only)
python apileaks.py dir \
  --target https://api.example.com \
  --no-recursive

# Deep + thorough: recurse further with a request budget as a safety net
python apileaks.py dir \
  --target https://api.example.com \
  --depth 6 \
  --max-requests 5000

# Tune concurrency for faster discovery (default is 50 in-flight requests)
python apileaks.py dir \
  --target https://api.example.com \
  --concurrency 100 \
  --max-requests 8000

# Let the APILEAK_MAX_DEPTH env var drive depth (CLI --depth would override it)
APILEAK_MAX_DEPTH=4 python apileaks.py dir \
  --target https://api.example.com

# Group/filter by status class and save a structured session (source of truth)
python apileaks.py dir \
  --target https://api.example.com \
  --status-code 2xx \
  --save-session session.json

# Save a session AND write a human-readable Markdown export
python apileaks.py dir \
  --target https://api.example.com \
  --save-session session.json \
  --export md \
  --export-file discovery.md

# Plain-text export instead of Markdown
python apileaks.py dir \
  --target https://api.example.com \
  --export txt \
  --export-file discovery.txt

# Reload a prior session (no re-discovery) and re-render the triage table
python apileaks.py dir \
  --target https://api.example.com \
  --load-session session.json

# Reload a session and filter to server errors
python apileaks.py dir \
  --target https://api.example.com \
  --load-session session.json \
  --status-code 5xx

# Interactive triage: pick one endpoint for a targeted follow-up scan (opt-in)
python apileaks.py dir \
  --target https://api.example.com \
  --load-session session.json \
  --interactive

# CI-safe: --ci-mode disables the interactive prompt so it never blocks a pipeline
python apileaks.py dir \
  --target https://api.example.com \
  --interactive \
  --ci-mode \
  --save-session session.json \
  --export md \
  --export-file discovery.md

# Full triage workflow in a single run
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --rate-limit 10 \
  --detect-framework \
  --status-code 2xx \
  --save-session session.json \
  --export md \
  --export-file discovery.md \
  --interactive

# Random User-Agent + gentle rate limit, bounded recursive discovery,
# filter to successful endpoints, and save a session
python apileaks.py dir \
  --target https://api.example.com \
  --rate-limit 5 \
  --user-agent-random \
  --depth 4 \
  --max-requests 5000 \
  --status-code 2xx \
  --save-session session.json

# Single custom User-Agent + rate limit, with interactive triage —
# the follow-up scan inherits both the rate limit and the custom UA
python apileaks.py dir \
  --target https://api.example.com \
  --rate-limit 8 \
  --user-agent-custom "MyScanner/1.0" \
  --status-code 2xx \
  --save-session session.json \
  --interactive

# Rotating User-Agents from a file + rate limit, deep discovery with a budget,
# then open interactive triage (the follow-up reuses the same UA file rotation)
python apileaks.py dir \
  --target https://api.example.com \
  --rate-limit 10 \
  --user-agent-file wordlists/user_agents.txt \
  --depth 5 \
  --max-requests 8000 \
  --save-session session.json \
  --interactive

# Seed from a spec + multiple wordlists (merged & de-duplicated) and expand
# with extensions, then filter to successful endpoints and save a session
python apileaks.py dir \
  --target https://api.example.com \
  --openapi specs/openapi.yaml \
  --wordlist wordlists/endpoints.txt \
  --wordlist wordlists/admin_endpoints.txt \
  --extensions json,php \
  --status-code 2xx \
  --save-session session.json

# Read wordlist entries from stdin (`-`) and append extensions
cat wordlists/endpoints.txt | python apileaks.py dir \
  --target https://api.example.com \
  --wordlist - \
  -x .json -x .php \
  --depth 2

# Attach request context (headers, cookie, basic auth) to every request
python apileaks.py dir \
  --target https://api.example.com \
  -H "X-API-Key: key123" \
  -H "X-Tenant: acme" \
  --cookie "session=abc123" \
  --basic-auth admin:secret \
  --status-code 2xx \
  --save-session session.json

# Response matchers + filters to cut soft-404 noise (kept results must be
# larger than 100 bytes and not match "Not Found"); combine with --status-code
python apileaks.py dir \
  --target https://api.example.com \
  --status-code 200,403 \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --filter-words "<5"

# Enumerate allowed methods and probe for GraphQL introspection, bounded by a
# request budget and concurrency limit
python apileaks.py dir \
  --target https://api.example.com \
  --enumerate-methods \
  --graphql \
  --max-requests 5000 \
  --concurrency 100

# Per-request resilience against a slow / rate-limiting target
python apileaks.py dir \
  --target https://api.example.com \
  --timeout 30 \
  --retries 5 \
  --rate-limit 5

# Transport / TLS: mutual TLS, custom CA, DNS override, cross-domain redirects
python apileaks.py dir \
  --target https://api.example.com \
  --client-cert client.pem \
  --ca-bundle ca.pem \
  --resolve api.example.com:127.0.0.1 \
  --allow-cross-domain-redirects

# Route discovery through a SOCKS5 proxy with auth (requires httpx[socks])
python apileaks.py dir \
  --target https://api.example.com \
  --proxy socks5://user:pass@127.0.0.1:1080

# Secret detection (redacted) with custom patterns, plus machine-readable output
python apileaks.py dir \
  --target https://api.example.com \
  --detect-secrets \
  --secret-patterns config/secret_patterns.json \
  --status-code 2xx \
  --output-format jsonl \
  --output-file reports/discovery.jsonl

# Everything together: spec + multi-wordlist seeds, extensions, request context,
# matchers/filters, method+GraphQL probes, secret detection, machine output,
# and a saved session — CI-safe
python apileaks.py dir \
  --target https://api.example.com \
  --openapi specs/openapi.yaml \
  --wordlist wordlists/endpoints.txt \
  --wordlist - \
  --extensions json,php \
  -H "X-API-Key: key123" \
  --cookie "session=abc123" \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --enumerate-methods \
  --graphql \
  --timeout 20 \
  --retries 3 \
  --detect-secrets \
  --status-code 2xx \
  --save-session session.json \
  --output-format csv \
  --output-file reports/discovery.csv \
  --ci-mode

# scan reusing the shared robustness flags (extensions, timeout, retries)
python apileaks.py scan \
  --target https://api.example.com \
  --extensions json,php \
  --timeout 20 \
  --retries 3 \
  --depth 2 \
  --modules bola,auth

# Storage-time path scope: persist only /api/* endpoints, drop static assets.
# Exclude takes precedence over include.
python apileaks.py dir \
  --target https://api.example.com \
  --include-path "^/api/" \
  --exclude-path "\.(png|jpg|css|js)$" \
  --save-session session.json

# Storage-time status scope: persist only 2xx, drop 404s. Distinct from the
# display-only --status-code: dropped records never reach the session or output.
python apileaks.py dir \
  --target https://api.example.com \
  --include-status 2xx \
  --exclude-status 404 \
  --output-format jsonl \
  --output-file reports/discovery.jsonl

# Combine storage-time scope with display-only matchers/filters: scope decides
# what is stored, matchers/filters decide what is shown from the stored set
python apileaks.py dir \
  --target https://api.example.com \
  --include-path "^/api/" \
  --include-status 2xx \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --save-session session.json

# Recursion scope: only descend into 2xx/3xx admin and api_version endpoints.
# Only narrows the default VALID/AUTH_REQUIRED recursion; never relaxes it.
python apileaks.py dir \
  --target https://api.example.com \
  --depth 4 \
  --max-requests 5000 \
  --recursion-status 2xx,3xx \
  --recursion-type admin,api_version

# Recursion scope also works on the scan command
python apileaks.py scan \
  --target https://api.example.com \
  --depth 3 \
  --recursion-type admin,api_version \
  --modules bola,auth

# Hit confirmation: re-request each interesting candidate 3 times and record it
# only when the responses are consistent (reduces false positives)
python apileaks.py dir \
  --target https://api.example.com \
  --confirm-hits 3 \
  --rate-limit 5 \
  --status-code 2xx

# Batch scan scope (non-interactive): discover, then run an OWASP scan over all
# VALID discovered endpoints. CI-safe — the interactive prompt never runs.
python apileaks.py dir \
  --target https://api.example.com \
  --scan-scope valid \
  --ci-mode

# Batch scan scope by status class, with request context inherited by the scan
python apileaks.py dir \
  --target https://api.example.com \
  -H "X-API-Key: key123" \
  --rate-limit 8 \
  --scan-scope 2xx

# Interactive multi-select: enter "1,3,5" or "2-4" at the prompt to batch-scan
# those records; a single index keeps the single-endpoint follow-up
python apileaks.py dir \
  --target https://api.example.com \
  --interactive

# Checkpoint a long run so it can be resumed after an interruption (atomic writes)
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/big.txt \
  --max-requests 50000 \
  --checkpoint reports/scan.ckpt

# Resume from the checkpoint and keep checkpointing the resumed run. Already
# tested candidates are not re-requested; results merge with no duplicates.
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/big.txt \
  --resume reports/scan.ckpt \
  --checkpoint reports/scan.ckpt

# Everything together: storage-time scope + recursion scope + hit confirmation,
# checkpointed, then batch-scan the VALID endpoints — CI-safe
python apileaks.py dir \
  --target https://api.example.com \
  --include-path "^/api/" \
  --exclude-path "\.(png|jpg|css|js)$" \
  --include-status 2xx \
  --recursion-status 2xx,3xx \
  --recursion-type admin,api_version \
  --confirm-hits 2 \
  --max-requests 20000 \
  --checkpoint reports/scan.ckpt \
  --scan-scope valid \
  --ci-mode

# Single-marker version sweep: fuzz just the API version segment. The one
# wordlist is the marker's wordlist; bounded by a rate limit and request budget.
python apileaks.py dir \
  --target "https://api.example.com/FUZZ/users" \
  --wordlist wordlists/versions.txt \
  --rate-limit 10 \
  --max-requests 2000 \
  --status-code 2xx

# Two markers, clusterbomb (default): every version × every filename. The first
# --wordlist pairs with the first marker (version), the second with the filename.
# Confirm interesting hits to cut false positives.
python apileaks.py dir \
  --target "https://api.example.com/FUZZ/FUZZ" \
  --wordlist wordlists/versions.txt \
  --wordlist wordlists/filenames.txt \
  --confirm-hits 2 \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --max-requests 5000

# Two markers, pitchfork: pair the i-th version with the i-th filename in
# lockstep (stops at the shortest list) instead of exploding into all combos.
python apileaks.py dir \
  --target "https://api.example.com/FUZZ/FUZZ" \
  --fuzz-mode pitchfork \
  --wordlist wordlists/versions.txt \
  --wordlist wordlists/filenames.txt \
  --rate-limit 8 \
  --status-code 2xx,403

# Custom keyword to avoid colliding with legitimate URL text (here "FUZZ" could
# appear literally, so a distinct marker token is used instead)
python apileaks.py dir \
  --target "https://api.example.com/__M__/report.__M__" \
  --fuzz-keyword __M__ \
  --wordlist wordlists/versions.txt \
  --wordlist wordlists/extensions.txt \
  --confirm-hits 3 \
  --max-requests 4000

# Discover hidden parameters using the default wordlist
python apileaks.py par --target https://api.example.com/users/123

# With a custom wordlist
python apileaks.py par \
  --target https://api.example.com/api/v1/products \
  --wordlist wordlists/parameters.txt

# Fuzz with JWT authentication
python apileaks.py par \
  --target https://api.example.com/api/v1/account \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# Fuzz only POST body parameters
python apileaks.py par \
  --target https://api.example.com/api/v1/orders \
  --methods POST

# Limit total requests issued
python apileaks.py par \
  --target https://api.example.com/search \
  --max-requests 500

# Hit confirmation: only report stable findings (reduces false positives)
python apileaks.py par \
  --target https://api.example.com/api/v1/search \
  --confirm-hits 3 \
  --max-requests 1500

# Multiple wordlists merged and de-duplicated
python apileaks.py par \
  --target https://api.example.com/api/v1/users \
  --wordlist wordlists/parameters.txt \
  --wordlist wordlists/admin_params.txt

# Request context: custom headers, cookie, and basic auth
python apileaks.py par \
  --target https://internal-api.example.com/config \
  -H "X-API-Key: sk_live_abc123" \
  -H "X-Tenant: acme" \
  --cookie "session=abc123" \
  --basic-auth admin:s3cr3t

# Resilience for slow targets with concurrent requests
python apileaks.py par \
  --target https://slow-api.example.com/endpoint \
  --timeout 30 \
  --retries 3 \
  --rate-limit 5 \
  --concurrency 25

# Response matchers: only report findings with large response bodies
python apileaks.py par \
  --target https://api.example.com/api/v1/data \
  --match-size ">200" \
  --filter-regex "Not Found"

# WAF evasion with random user agents and conservative pacing
python apileaks.py par \
  --target https://protected-api.example.com/endpoint \
  --user-agent-random \
  --rate-limit 3 \
  --timeout 20

# Full-featured authenticated scan: confirmation, budget, matchers, machine output
python apileaks.py par \
  --target https://api.example.com/api/v1/users/me \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "X-Correlation-ID: pentest-001" \
  --wordlist wordlists/parameters.txt \
  --wordlist wordlists/debug_params.txt \
  --methods GET,POST \
  --confirm-hits 3 \
  --max-requests 2000 \
  --rate-limit 10 \
  --timeout 20 \
  --concurrency 25 \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --output-format jsonl \
  --output-file reports/par_findings.jsonl

# Mutual TLS + DNS override for internal APIs
python apileaks.py par \
  --target https://internal-api.example.com/admin \
  --client-cert certs/client.pem \
  --ca-bundle certs/internal-ca.pem \
  --resolve internal-api.example.com:10.0.1.50 \
  --basic-auth auditor:pass \
  --wordlist wordlists/parameters.txt \
  --confirm-hits 2

# CI pipeline: bounded, quiet, machine-readable
python apileaks.py par \
  --target "${API_ENDPOINT}" \
  --jwt "${JWT_TOKEN}" \
  --wordlist wordlists/parameters.txt \
  --methods GET,POST \
  --confirm-hits 2 \
  --max-requests 1000 \
  --match-size ">100" \
  --filter-regex "Not Found" \
  --output-format jsonl \
  --output-file reports/par_ci.jsonl \
  --no-banner

# Through an intercepting proxy (Burp/Caido)
python apileaks.py par \
  --target https://api.example.com/api/v1/orders \
  --proxy http://127.0.0.1:8080 \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

# E-commerce: find debug/admin parameters on the checkout endpoint
python apileaks.py par \
  --target https://shop.example.com/api/checkout \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "X-Cart-ID: test-cart-001" \
  --wordlist wordlists/parameters.txt \
  --wordlist wordlists/ecommerce_params.txt \
  --methods POST \
  --confirm-hits 3 \
  --max-requests 1500 \
  --rate-limit 8 \
  --output-format jsonl \
  --output-file reports/checkout_params.jsonl

# Simple scan (runs discovery + all OWASP modules by default)
python apileaks.py scan --target https://api.example.com

# With configuration file
python apileaks.py scan \
  --config config/api_config.yaml \
  --target https://api.example.com

# With WAF evasion and OWASP modules
python apileaks.py scan \
  --target https://api.example.com \
  --user-agent-file wordlists/user_agents.txt \
  --modules bola,auth,property \
  --rate-limit 5 \
  --output comprehensive_security_scan

# With custom user agent and status filtering
python apileaks.py scan \
  --config config/api_config.yaml \
  --target https://api.example.com \
  --user-agent-custom "Enterprise Security Scanner" \
  --status-code 200,401,403,500 \
  --output enterprise_scan

# With framework and version detection (all modules run by default)
python apileaks.py scan \
  --target https://api.example.com \
  --detect-framework \
  --fuzz-versions \
  --framework-confidence 0.8 \
  --user-agent-random \
  --output advanced_discovery_scan

# Shallow + fast discovery ahead of the OWASP modules
python apileaks.py scan \
  --target https://api.example.com \
  --depth 1 \
  --modules bola,auth

# Deep + thorough discovery with a request budget as a safety net
python apileaks.py scan \
  --target https://api.example.com \
  --depth 6 \
  --max-requests 5000 \
  --concurrency 100

# Skip recursive discovery entirely (depth-0 pass only)
python apileaks.py scan \
  --target https://api.example.com \
  --no-recursive

# Detect API framework
python apileaks.py scan \
  --target https://api.example.com \
  --detect-framework \
  --framework-confidence 0.8 \
  --output framework_detection

# Framework detection with confidence threshold
python apileaks.py scan \
  --target https://api.example.com \
  --detect-framework \
  --framework-confidence 0.9 \
  --user-agent-random

# Discover API versions
python apileaks.py scan \
  --target https://api.example.com \
  --fuzz-versions \
  --version-patterns "/v1,/v2,/api/v1,/api/v2" \
  --output version_discovery

# Version fuzzing with custom patterns
python apileaks.py scan \
  --target https://api.example.com \
  --fuzz-versions \
  --version-patterns "/version1,/version2,/rest/v1,/rest/v2" \
  --user-agent-random

# Framework detection and version fuzzing
python apileaks.py scan \
  --target https://api.example.com \
  --detect-framework \
  --fuzz-versions \
  --framework-confidence 0.7 \
  --user-agent-random \
  --output combined_discovery

# With directory fuzzing integration
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --detect-framework \
  --fuzz-versions \
  --user-agent-random \
  --output integrated_discovery

# Short flags for convenience
python apileaks.py scan \
  --target https://api.example.com \
  --df \
  --fv \
  --framework-confidence 0.9 \
  --user-agent-random

# Basic JWT authentication
python apileaks.py scan \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --modules auth,bola \
  --output jwt_security_test

# JWT with parameter fuzzing
python apileaks.py par \
  --target https://api.example.com/protected \
  --wordlist wordlists/parameters.txt \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --user-agent-random \
  --output jwt_param_test

# JWT with directory fuzzing
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/admin_endpoints.txt \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --status-code 200,401,403 \
  --output jwt_endpoint_test

# API key in header
python apileaks.py scan \
  --target https://api.example.com \
  --header "X-API-Key: your-api-key" \
  --modules auth,bola \
  --output api_key_test

# API key in query parameter
python apileaks.py par \
  --target "https://api.example.com?api_key=your-key" \
  --wordlist wordlists/parameters.txt \
  --output api_key_param_test

# List every module (key, OWASP category, one-line summary)
python apileaks.py owasp

# Run exactly one module against a target
python apileaks.py owasp <key> --target https://api.example.com

# BOLA (Broken Object Level Authorization) testing — single module in isolation
python apileaks.py owasp bola \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --output bola_security_test

# Authentication testing — single module in isolation
python apileaks.py owasp auth \
  --target https://api.example.com \
  --user-agent-random \
  --output auth_security_test

# Property-level authorization testing — single module in isolation
python apileaks.py owasp property \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --output property_auth_test

# Multiple OWASP modules — aggregate a subset through scan
python apileaks.py scan \
  --target https://api.example.com \
  --modules bola,auth,property \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --user-agent-random \
  --output comprehensive_owasp_test

# Run all implemented OWASP modules (scan runs every module by default,
# so no --modules flag is needed)
python apileaks.py scan \
  --target https://api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --user-agent-random \
  --rate-limit 8 \
  --output complete_owasp_assessment

# Only show successful responses
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --status-code 200-299 \
  --user-agent-random \
  --output success_endpoints

# Focus on specific success codes
python apileaks.py par \
  --target https://api.example.com \
  --wordlist wordlists/parameters.txt \
  --status-code 200,201,202 \
  --output successful_parameters

# Server error analysis
python apileaks.py par \
  --target https://api.example.com/search \
  --wordlist wordlists/injection_params.txt \
  --status-code 500-599 \
  --output server_errors

# Client error analysis
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --status-code 400-499 \
  --output client_errors

# Authentication-related responses
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/admin_endpoints.txt \
  --status-code 401,403 \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --output auth_responses

# Mixed authentication and success responses
python apileaks.py scan \
  --target https://api.example.com \
  --status-code 200,401,403 \
  --modules bola,auth \
  --output auth_focused_scan

# Fast directory fuzzing
python apileaks.py dir \
  --target https://api.example.com \
  --wordlist wordlists/endpoints.txt \
  --rate-limit 50 \
  --status-code 200-299 \
  --user-agent-random

# Fast parameter discovery
python apileaks.py par \
  --target https://api.example.com \
  --wordlist wordlists/parameters.txt \
  --rate-limit 30 \
  --methods GET,POST \
  --status-code 200,500-599

# Slow and careful scanning
python apileaks.py scan \
  --target https://api.example.com \
  --rate-limit 2 \
  --user-agent-random \
  --modules bola,auth \
  --output careful_scan

# Respectful parameter testing
python apileaks.py par \
  --target https://api.example.com \
  --wordlist wordlists/parameters.txt \
  --rate-limit 5 \
  --user-agent-custom "Authorized Security Test" \
  --output respectful_param_test

# Traditional usage with config file
python apileaks.py scan \
  --config config/api_config.yaml \
  --target https://api.example.com

# With custom configuration
python apileaks.py scan \
  --config config/comprehensive_config.yaml \
  --target https://api.example.com \
  --output legacy_scan

# Comprehensive e-commerce API security assessment
python apileaks.py scan \
  --target https://api.ecommerce.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --modules bola,auth,property \
  --user-agent-random \
  --status-code 200,401,403,500 \
  --detect-framework \
  --output ecommerce_security_assessment

# Conservative banking API testing
python apileaks.py scan \
  --target https://api.bank.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --modules bola,auth,property \
  --user-agent-custom "Authorized Security Assessment" \
  --rate-limit 2 \
  --status-code 200,401,403 \
  --output banking_security_test

# Mobile app backend API testing
python apileaks.py scan \
  --target https://mobile-api.example.com \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --modules bola,auth,property \
  --user-agent-file mobile_user_agents.txt \
  --detect-framework \
  --fuzz-versions \
  --output mobile_api_security_test

# Individual microservice testing
python apileaks.py scan \
  --target https://user-service.example.com \
  --modules bola,auth \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --user-agent-random \
  --output user_service_test

python apileaks.py scan \
  --target https://payment-service.example.com \
  --modules bola,auth,property \
  --jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --user-agent-random \
  --output payment_service_test

# If you encounter rate limiting (429 responses)
python apileaks.py dir \
  --target https://api.example.com \
  --rate-limit 1 \
  --user-agent-random \
  --wordlist wordlists/endpoints.txt

# If WAF is blocking requests
python apileaks.py par \
  --target https://api.example.com \
  --user-agent-file realistic_agents.txt \
  --rate-limit 3 \
  --wordlist wordlists/parameters.txt

# For APIs with large responses
python apileaks.py scan \
  --target https://api.example.com \
  --status-code 200-299 \
  --rate-limit 5 \
  --modules bola,auth