API Security & GraphQL Fuzzing

Description

OpenAPI parsing, GraphQL introspection, BOLA/IDOR/injection fuzzing per OWASP API Top 10.

What already exists

• Kiterunner API bruteforcer with 354K+ Swagger/OpenAPI-derived routes
• GraphQL endpoint detection (/graphql, /gql, /api/graphql)
• BOLA/IDOR risk classification (id_params detection)
• Nuclei DAST mode for active fuzzing
• API parameter categorization (id, file, auth, redirect, command params)

What needs to be built

• GraphQL introspection and schema enumeration
• GraphQL query/mutation fuzzing
• OpenAPI spec parsing for automated test case generation
• Dedicated BOLA/IDOR automated exploitation
• JWT/OAuth/API key authentication testing
• CORS/CSRF API testing
• Rate limiting bypass detection
• OWASP API Top 10 coverage mapping