DOCSEARCHbyAlgolia
Submit Docs

ChkApi Documentation

repository·master·Indexed 19 days ago

https://github.com/0x727/chkapi_0x727

An automated API security detection tool for auditing web assets. ChkApi discovers API endpoints from JS files and Swagger docs, performs intelligent parameter extraction, and executes fuzzing and bypass techniques to identify vulnerabilities such as RCE, SSRF, and unauthorized access. It supports Python 3.8+ and utilizes chromedriver for browser automation.

Tokens
1.3K
Snippets
2
Records
5
Agent score
18%

What's inside ChkApi

  1. How ChkApi performs API security detection

    master

    ChkApi follows a multi-step automated workflow to discover and test API endpoints:

    1. Asset Discovery: It extracts automatically loaded JS files (from current, CDN, or other domains) and static HTML addresses to map the target's attack surface.
    2. JS & Webpack Parsing: It uses regex to find JS addresses within page source and extracts specific chunk paths from Webpack-bundled files.
    3. Base URL Identification: It identifies microservice entry points (Base URLs) by analyzing URL paths in automatically loaded assets.
    4. API Extraction & Fuzzing: It extracts API paths from JS files using regex and supplements them using built-in API dictionaries via fuzzing.
    5. Swagger Parsing: It supports various Swagger versions to extract precise request methods, parameter names, and types.
    6. Parameter Intelligence: It performs "parameter intelligence" by analyzing response bodies to find keys, values associated with param/parameter keys, or missing parameters mentioned in error messages.
    7. Testing Modes: It tests endpoints using three request types: GET, POST DATA, and POST JSON. It performs both parameterless requests (to find structure) and parameterized requests (to find vulnerabilities).
    8. Bypass Testing: For endpoints returning 301, 302, 401, 404, or empty responses, it applies over ten different bypass techniques to attempt to force a valid response.

  2. Contributing to ChkApi

    master

    ChkApi is an open-source project and welcomes contributions. Follow these guidelines for contributing:

    • Bug Fixes: Submit a Pull Request directly to the dev branch. The master branch is reserved for stable releases.
    • New Features: Create an issue first with a description and a proposed implementation method. Once the proposal is accepted, you may submit a Pull Request.
    • Documentation: Improvements to the documentation are encouraged to help more users.
    • Issue Reporting: Use the GitHub Issues feature to report problems. This helps other users find solutions and prevents redundant answers.

    Important: Always target the dev branch for code contributions.

  3. Install ChkApi

    master

    ChkApi requires a Python 3.8+ environment. It is recommended to use Ubuntu 20 on a VPS. The tool requires chromedriver for browser automation. The repository includes a build.sh script that automates the installation process, including the setup for Linux environments. If you are using macOS, you must install chromedriver manually.

    To install, make the build script executable and run it:

    chmod 777 build.sh
./build.sh

  4. Review ChkApi scan results and data organization

    master

    ChkApi organizes its findings into structured formats (Text and Excel) to support vulnerability discovery. Key data categories include:

    • API Endpoints: Lists extracted api_path and their associated Base URL.
    • Parameters: A list of all intelligently extracted parameter names.
    • Request Results: Detailed logs of GET, POST DATA, and POST JSON requests, including HTTP status codes, response length, and response type.
    • Response Differentiation: Uses content_hash to group identical responses, helping you filter out repetitive "Unauthorized" or "Missing Token" messages to focus on unique responses.
    • Sensitive Information: Specifically flags leaks such as JDBC connection strings, credentials, private keys, and cloud provider (e.g., AKSK) tokens.

    Vulnerability Hunting Tips:

    • RCE: Search api_url or parameter for keywords like ping, cmd, or command.
    • SSRF/Redirect: Search for url or ip.
    • File Upload/Read: Search for upload, download, read, or file.
    • Unauthorized Access: Search for get or config.

  5. Use ChkApi CLI

    master

    The main entry point for the tool is ChkApi.py. You can use various flags to control the scanning behavior, such as targeting specific URLs, providing cookies, or scanning from a file.

    Command Line Arguments Reference:

    FlagDescription
    -u <url>Scan a single URL
    -c "<cookies>"Scan a single URL while carrying provided cookies
    -f <file>Scan multiple websites listed in a text file
    --chrome <on/off>Enable or disable chromedriver (default is on)
    --at <0/1>Control collection + detection mode: 0 for collection + detection, 1 for collection only (default is 0)
    --na <0/1>Control API vulnerability scanning: 0 to scan, 1 to skip (default is 0)
    # Scan a single URL
python3 ChkApi.py -u http://www.aaa.com

# Scan a single URL with cookies
python3 ChkApi.py -u http://www.aaa.com -c "xxxxxxxxxx"

# Scan websites from a file
python3 ChkApi.py -f url.txt

# Disable chromedriver
python3 ChkApi.py -u http://www.aaa.com --chrome off

# Collection only mode (skip detection)
python3 ChkApi.py -u http://www.aaa.com --at 1

# Skip API vulnerability scanning
python3 ChkApi.py -u http://www.aaa.com --na 1