[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE8ZC6GZX2KN0Y3XHTYQPK":3,"skill-same:01M6AE8ZC6GZX2KN0Y3XHTYQPK":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AE8ZC6GZX2KN0Y3XHTYQPK","detecting-api-enumeration-attacks",null,"Detect API enumeration attacks (BOLA\u002FIDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200\u002F401\u002F403 response patterns from API gateway and WAF logs. Use when investigating suspected object-level authorization abuse, building threat-hunting queries for API access-control bypass, or hardening API logging\u002Frate-limiting against enumeration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-api-enumeration-attacks\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"detecting api enumeration attacks","api-security","broken-object-level-authorization","idor","bola","enumeration","detection","owasp","hardening","threat-hunting","writing","waf","logs","gateway","api gateway","logging","pr","siem","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: detecting-api-enumeration-attacks\ndescription: Detect API enumeration attacks (BOLA\u002FIDOR, OWASP API1:2023) by writing SIEM\n  detection rules that flag sequential or UUID identifier iteration, parameter tampering,\n  and mixed 200\u002F401\u002F403 response patterns from API gateway and WAF logs. Use when\n  investigating suspected object-level authorization abuse, building threat-hunting\n  queries for API access-control bypass, or hardening API logging\u002Frate-limiting against\n  enumeration.\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- enumeration\n- bola\n- idor\n- broken-object-level-authorization\n- owasp-api-top-10\n- access-control\n- rate-limiting\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1595\n- T1595.002\n- T1046\n- T1190\n- T1087\n---\n\n# Detecting API Enumeration Attacks\n\n## Overview\n\nAPI enumeration attacks occur when attackers systematically probe API endpoints with sequential or predictable identifiers to discover and access unauthorized resources. Broken Object Level Authorization (BOLA), ranked as API1:2023 in the OWASP API Security Top 10, is the most critical API vulnerability. Attackers manipulate object identifiers (user IDs, order numbers, account references) in API requests to bypass authorization and access other users' data. Detection requires monitoring for patterns of rapid sequential access attempts, authorization failures, and abnormal API usage behavior.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting api enumeration attacks\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- API gateway or reverse proxy with logging enabled (Kong, AWS API Gateway, Apigee)\n- SIEM platform (Splunk, Elastic SIEM, or Microsoft Sentinel)\n- Access to API server logs with request details\n- Web Application Firewall (WAF) with API protection capabilities\n- Understanding of the API's authorization model and object identifier schemes\n\n## Attack Patterns to Detect\n\n### 1. Sequential ID Enumeration\n\nAttackers iterate through numeric or predictable identifiers:\n\n```\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1001 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1002 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1003 -> 403 Forbidden\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1004 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1005 -> 200 OK\n...\n```\n\n**Detection Indicators:**\n- Rapid sequential requests to the same endpoint with incrementing IDs\n- Mix of 200\u002F403\u002F401 responses from same source\n- Request rate exceeding normal user behavior\n- Access to resources outside authenticated user's scope\n\n### 2. UUID\u002FGUID Enumeration\n\nEven non-sequential identifiers can be enumerated if leaked through other endpoints:\n\n```\n# Attacker first harvests UUIDs from a list endpoint\nGET \u002Fapi\u002Fv1\u002Fposts?page=1  -> Returns post objects with author UUIDs\n\n# Then uses those UUIDs to access restricted user data\nGET \u002Fapi\u002Fv1\u002Fusers\u002Fa3f2c1e4-... -> Private user profile\nGET \u002Fapi\u002Fv1\u002Fusers\u002Fb7d9e8f1-... -> Private user profile\n```\n\n### 3. Parameter Tampering Enumeration\n\n```\n# Authenticated as user_id=100, attempting to access other users' orders\nGET \u002Fapi\u002Fv1\u002Forders?user_id=101\nGET \u002Fapi\u002Fv1\u002Forders?user_id=102\nGET \u002Fapi\u002Fv1\u002Forders?user_id=103\n```\n\n## Detection Rules\n\n### Splunk Detection Queries\n\n```spl\n# Detect sequential ID enumeration on API endpoints\nindex=api_logs sourcetype=api_access\n| rex field=uri_path \"(?\u003Cendpoint>\u002Fapi\u002Fv\\d+\u002F\\w+\u002F)(?\u003Cobject_id>\\d+)\"\n| stats count as request_count,\n        dc(object_id) as unique_ids,\n        values(status_code) as status_codes,\n        min(_time) as first_seen,\n        max(_time) as last_seen\n  by src_ip, endpoint, user_session\n| eval time_span = last_seen - first_seen\n| eval requests_per_second = request_count \u002F max(time_span, 1)\n| where unique_ids > 20 AND requests_per_second > 2\n| eval severity = case(\n    unique_ids > 100, \"critical\",\n    unique_ids > 50, \"high\",\n    unique_ids > 20, \"medium\",\n    1==1, \"low\"\n  )\n| sort - unique_ids\n| table src_ip, endpoint, unique_ids, request_count, requests_per_second,\n        status_codes, severity\n\n# Detect BOLA via authorization failure patterns\nindex=api_logs sourcetype=api_access status_code IN (401, 403)\n| bin _time span=5m\n| stats count as failure_count,\n        dc(uri_path) as unique_paths,\n        values(uri_path) as attempted_paths\n  by _time, src_ip, user_id\n| where failure_count > 10\n| eval attack_type = if(unique_paths > 5, \"enumeration\", \"brute_force\")\n```\n\n### Elastic SIEM Detection Rules\n\n```json\n{\n  \"rule\": {\n    \"name\": \"API Object Enumeration Detection\",\n    \"description\": \"Detects rapid sequential access to API objects with mixed authorization results\",\n    \"type\": \"threshold\",\n    \"index\": [\"api-access-*\"],\n    \"query\": {\n      \"bool\": {\n        \"must\": [\n          { \"regexp\": { \"url.path\": \"\u002Fapi\u002Fv[0-9]+\u002F[a-z]+\u002F[0-9]+\" } }\n        ],\n        \"should\": [\n          { \"term\": { \"http.response.status_code\": 200 } },\n          { \"term\": { \"http.response.status_code\": 403 } },\n          { \"term\": { \"http.response.status_code\": 401 } }\n        ]\n      }\n    },\n    \"threshold\": {\n      \"field\": [\"source.ip\"],\n      \"value\": 50,\n      \"cardinality\": [\n        { \"field\": \"url.path\", \"value\": 20 }\n      ]\n    },\n    \"schedule\": { \"interval\": \"5m\" },\n    \"severity\": \"high\",\n    \"risk_score\": 73,\n    \"tags\": [\"OWASP-API1\", \"BOLA\", \"Enumeration\"]\n  }\n}\n```\n\n### Custom Detection Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"API Enumeration Attack Detector\n\nAnalyzes API access logs to detect enumeration patterns\nincluding BOLA, IDOR, and sequential ID probing.\n\"\"\"\n\nimport re\nimport sys\nimport json\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom dataclasses import dataclass, field\nfrom typing import List, Dict, Optional\n\n@dataclass\nclass AccessRecord:\n    timestamp: datetime\n    source_ip: str\n    user_id: Optional[str]\n    method: str\n    path: str\n    status_code: int\n    object_id: Optional[str] = None\n\n@dataclass\nclass EnumerationAlert:\n    source_ip: str\n    user_id: Optional[str]\n    endpoint_pattern: str\n    unique_object_ids: int\n    total_requests: int\n    time_window_seconds: float\n    requests_per_second: float\n    auth_failure_ratio: float\n    severity: str\n    attack_type: str\n    sample_ids: List[str] = field(default_factory=list)\n\nclass EnumerationDetector:\n    # Regex patterns for extracting object IDs from API paths\n    ID_PATTERNS = [\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F(\\d+)'),           # Numeric IDs\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F([a-f0-9\\-]{36})'), # UUIDs\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F([a-zA-Z0-9]{20,})'), # Long alphanumeric IDs\n    ]\n\n    def __init__(self, time_window_minutes: int = 5,\n                 min_unique_ids: int = 15,\n                 max_requests_per_second: float = 5.0):\n        self.time_window = timedelta(minutes=time_window_minutes)\n        self.min_unique_ids = min_unique_ids\n        self.max_rps = max_requests_per_second\n        self.access_log: List[AccessRecord] = []\n\n    def parse_log_line(self, line: str) -> Optional[AccessRecord]:\n        \"\"\"Parse a common log format line into an AccessRecord.\"\"\"\n        log_pattern = re.compile(\n            r'(?P\u003Cip>[\\d.]+)\\s+\\S+\\s+(?P\u003Cuser>\\S+)\\s+'\n            r'\\[(?P\u003Ctime>[^\\]]+)\\]\\s+'\n            r'\"(?P\u003Cmethod>\\w+)\\s+(?P\u003Cpath>\\S+)\\s+\\S+\"\\s+'\n            r'(?P\u003Cstatus>\\d+)'\n        )\n        match = log_pattern.match(line)\n        if not match:\n            return None\n\n        path = match.group('path')\n        object_id = None\n        for pattern in self.ID_PATTERNS:\n            id_match = pattern.search(path)\n            if id_match:\n                object_id = id_match.group(2)\n                break\n\n        return AccessRecord(\n            timestamp=datetime.strptime(match.group('time'), '%d\u002F%b\u002F%Y:%H:%M:%S %z'),\n            source_ip=match.group('ip'),\n            user_id=match.group('user') if match.group('user') != '-' else None,\n            method=match.group('method'),\n            path=path,\n            status_code=int(match.group('status')),\n            object_id=object_id\n        )\n\n    def analyze(self, records: List[AccessRecord]) -> List[EnumerationAlert]:\n        \"\"\"Analyze access records for enumeration patterns.\"\"\"\n        alerts = []\n\n        # Group by source IP and endpoint pattern\n        grouped = defaultdict(list)\n        for record in records:\n            if record.object_id:\n                # Normalize endpoint by removing the specific object ID\n                endpoint = re.sub(r'\u002F[a-f0-9\\-]{36}', '\u002F{id}',\n                         re.sub(r'\u002F\\d+', '\u002F{id}', record.path))\n                key = (record.source_ip, record.user_id, endpoint)\n                grouped[key].append(record)\n\n        for (src_ip, user_id, endpoint), records_group in grouped.items():\n            if len(records_group) \u003C self.min_unique_ids:\n                continue\n\n            # Sort by timestamp\n            records_group.sort(key=lambda r: r.timestamp)\n\n            # Analyze time windows\n            window_start = 0\n            for window_start in range(len(records_group)):\n                window_records = []\n                for r in records_group[window_start:]:\n                    if r.timestamp - records_group[window_start].timestamp \u003C= self.time_window:\n                        window_records.append(r)\n\n                unique_ids = set(r.object_id for r in window_records)\n                if len(unique_ids) \u003C self.min_unique_ids:\n                    continue\n\n                time_span = (window_records[-1].timestamp -\n                           window_records[0].timestamp).total_seconds()\n                rps = len(window_records) \u002F max(time_span, 1)\n\n                auth_failures = sum(1 for r in window_records\n                                   if r.status_code in (401, 403))\n                failure_ratio = auth_failures \u002F len(window_records)\n\n                # Determine severity\n                if len(unique_ids) > 100:\n                    severity = \"critical\"\n                elif len(unique_ids) > 50 or failure_ratio > 0.5:\n                    severity = \"high\"\n                elif len(unique_ids) > 20:\n                    severity = \"medium\"\n                else:\n                    severity = \"low\"\n\n                # Determine attack type\n                ids_list = sorted([r.object_id for r in window_records\n                                  if r.object_id and r.object_id.isdigit()])\n                is_sequential = self._check_sequential(ids_list)\n                attack_type = \"sequential_enumeration\" if is_sequential else \"random_enumeration\"\n\n                alert = EnumerationAlert(\n                    source_ip=src_ip,\n                    user_id=user_id,\n                    endpoint_pattern=endpoint,\n                    unique_object_ids=len(unique_ids),\n                    total_requests=len(window_records),\n                    time_window_seconds=time_span,\n                    requests_per_second=round(rps, 2),\n                    auth_failure_ratio=round(failure_ratio, 2),\n                    severity=severity,\n                    attack_type=attack_type,\n                    sample_ids=list(unique_ids)[:10]\n                )\n                alerts.append(alert)\n                break  # One alert per group\n\n        return alerts\n\n    def _check_sequential(self, ids: List[str]) -> bool:\n        \"\"\"Check if numeric IDs follow a sequential pattern.\"\"\"\n        if len(ids) \u003C 5:\n            return False\n        try:\n            numeric_ids = sorted(int(i) for i in ids)\n            sequential_count = sum(\n                1 for i in range(1, len(numeric_ids))\n                if numeric_ids[i] - numeric_ids[i-1] \u003C= 2\n            )\n            return sequential_count \u002F len(numeric_ids) > 0.7\n        except ValueError:\n            return False\n\n\ndef main():\n    detector = EnumerationDetector(\n        time_window_minutes=5,\n        min_unique_ids=15\n    )\n\n    log_file = sys.argv[1] if len(sys.argv) > 1 else \"\u002Fvar\u002Flog\u002Fapi\u002Faccess.log\"\n    records = []\n    with open(log_file, 'r') as f:\n        for line in f:\n            record = detector.parse_log_line(line.strip())\n            if record:\n                records.append(record)\n\n    alerts = detector.analyze(records)\n\n    if alerts:\n        print(f\"\\n[!] {len(alerts)} enumeration attack(s) detected:\\n\")\n        for alert in alerts:\n            print(f\"  Source IP: {alert.source_ip}\")\n            print(f\"  User ID: {alert.user_id}\")\n            print(f\"  Endpoint: {alert.endpoint_pattern}\")\n            print(f\"  Unique IDs Accessed: {alert.unique_object_ids}\")\n            print(f\"  Requests\u002Fsec: {alert.requests_per_second}\")\n            print(f\"  Auth Failure Ratio: {alert.auth_failure_ratio}\")\n            print(f\"  Attack Type: {alert.attack_type}\")\n            print(f\"  Severity: {alert.severity.upper()}\")\n            print(f\"  Sample IDs: {alert.sample_ids}\")\n            print()\n    else:\n        print(\"[+] No enumeration attacks detected.\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Prevention Controls\n\n### Server-Side Authorization Enforcement\n\n```python\n# Always validate object ownership at the data layer\ndef get_user_order(request, order_id):\n    order = Order.objects.get(id=order_id)\n    if order.user_id != request.user.id:\n        raise PermissionDenied(\"Not authorized to access this order\")\n    return order\n```\n\n### Use Unpredictable Identifiers\n\n```python\nimport uuid\n\n# Use UUIDs instead of sequential integers\nclass Order(Model):\n    id = UUIDField(default=uuid.uuid4, primary_key=True)\n```\n\n### Implement Rate Limiting Per Endpoint\n\n```yaml\n# Kong rate limiting per API route\nplugins:\n  - name: rate-limiting\n    config:\n      minute: 30\n      policy: redis\n      limit_by: credential\n```\n\n## References\n\n- OWASP API1:2023 Broken Object Level Authorization: https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0xa1-broken-object-level-authorization\u002F\n- Traceable.ai BOLA Deep Dive: https:\u002F\u002Fwww.traceable.ai\u002Fblog-post\u002Fa-deep-dive-on-the-most-critical-api-vulnerability----bola-broken-object-level-authorization\n- Cequence BOLA Prevention: https:\u002F\u002Fwww.cequence.ai\u002Fsolutions\u002Fbola-and-enumeration-attack-prevention\u002F\n- Cloudflare API Shield BOLA Detection: https:\u002F\u002Fcommunity.cloudflare.com\u002Ft\u002Fapi-shield-new-bola-vulnerability-detection-for-api-shield\u002F883021\n- Sycope IDOR Detection via HTTP Traffic Analysis: https:\u002F\u002Fwww.sycope.com\u002Fpost\u002Fidor-vulnerability-how-to-detect-an-attack-on-web-applications-through-http-traffic-analysis\n","# Detecting API Enumeration Attacks\n\n## Overview\n\nAPI enumeration attacks occur when attackers systematically probe API endpoints with sequential or predictable identifiers to discover and access unauthorized resources. Broken Object Level Authorization (BOLA), ranked as API1:2023 in the OWASP API Security Top 10, is the most critical API vulnerability. Attackers manipulate object identifiers (user IDs, order numbers, account references) in API requests to bypass authorization and access other users' data. Detection requires monitoring for patterns of rapid sequential access attempts, authorization failures, and abnormal API usage behavior.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting api enumeration attacks\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- API gateway or reverse proxy with logging enabled (Kong, AWS API Gateway, Apigee)\n- SIEM platform (Splunk, Elastic SIEM, or Microsoft Sentinel)\n- Access to API server logs with request details\n- Web Application Firewall (WAF) with API protection capabilities\n- Understanding of the API's authorization model and object identifier schemes\n\n## Attack Patterns to Detect\n\n### 1. Sequential ID Enumeration\n\nAttackers iterate through numeric or predictable identifiers:\n\n```\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1001 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1002 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1003 -> 403 Forbidden\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1004 -> 200 OK\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1005 -> 200 OK\n...\n```\n\n**Detection Indicators:**\n- Rapid sequential requests to the same endpoint with incrementing IDs\n- Mix of 200\u002F403\u002F401 responses from same source\n- Request rate exceeding normal user behavior\n- Access to resources outside authenticated user's scope\n\n### 2. UUID\u002FGUID Enumeration\n\nEven non-sequential identifiers can be enumerated if leaked through other endpoints:\n\n```\n# Attacker first harvests UUIDs from a list endpoint\nGET \u002Fapi\u002Fv1\u002Fposts?page=1  -> Returns post objects with author UUIDs\n\n# Then uses those UUIDs to access restricted user data\nGET \u002Fapi\u002Fv1\u002Fusers\u002Fa3f2c1e4-... -> Private user profile\nGET \u002Fapi\u002Fv1\u002Fusers\u002Fb7d9e8f1-... -> Private user profile\n```\n\n### 3. Parameter Tampering Enumeration\n\n```\n# Authenticated as user_id=100, attempting to access other users' orders\nGET \u002Fapi\u002Fv1\u002Forders?user_id=101\nGET \u002Fapi\u002Fv1\u002Forders?user_id=102\nGET \u002Fapi\u002Fv1\u002Forders?user_id=103\n```\n\n## Detection Rules\n\n### Splunk Detection Queries\n\n```spl\n# Detect sequential ID enumeration on API endpoints\nindex=api_logs sourcetype=api_access\n| rex field=uri_path \"(?\u003Cendpoint>\u002Fapi\u002Fv\\d+\u002F\\w+\u002F)(?\u003Cobject_id>\\d+)\"\n| stats count as request_count,\n        dc(object_id) as unique_ids,\n        values(status_code) as status_codes,\n        min(_time) as first_seen,\n        max(_time) as last_seen\n  by src_ip, endpoint, user_session\n| eval time_span = last_seen - first_seen\n| eval requests_per_second = request_count \u002F max(time_span, 1)\n| where unique_ids > 20 AND requests_per_second > 2\n| eval severity = case(\n    unique_ids > 100, \"critical\",\n    unique_ids > 50, \"high\",\n    unique_ids > 20, \"medium\",\n    1==1, \"low\"\n  )\n| sort - unique_ids\n| table src_ip, endpoint, unique_ids, request_count, requests_per_second,\n        status_codes, severity\n\n# Detect BOLA via authorization failure patterns\nindex=api_logs sourcetype=api_access status_code IN (401, 403)\n| bin _time span=5m\n| stats count as failure_count,\n        dc(uri_path) as unique_paths,\n        values(uri_path) as attempted_paths\n  by _time, src_ip, user_id\n| where failure_count > 10\n| eval attack_type = if(unique_paths > 5, \"enumeration\", \"brute_force\")\n```\n\n### Elastic SIEM Detection Rules\n\n```json\n{\n  \"rule\": {\n    \"name\": \"API Object Enumeration Detection\",\n    \"description\": \"Detects rapid sequential access to API objects with mixed authorization results\",\n    \"type\": \"threshold\",\n    \"index\": [\"api-access-*\"],\n    \"query\": {\n      \"bool\": {\n        \"must\": [\n          { \"regexp\": { \"url.path\": \"\u002Fapi\u002Fv[0-9]+\u002F[a-z]+\u002F[0-9]+\" } }\n        ],\n        \"should\": [\n          { \"term\": { \"http.response.status_code\": 200 } },\n          { \"term\": { \"http.response.status_code\": 403 } },\n          { \"term\": { \"http.response.status_code\": 401 } }\n        ]\n      }\n    },\n    \"threshold\": {\n      \"field\": [\"source.ip\"],\n      \"value\": 50,\n      \"cardinality\": [\n        { \"field\": \"url.path\", \"value\": 20 }\n      ]\n    },\n    \"schedule\": { \"interval\": \"5m\" },\n    \"severity\": \"high\",\n    \"risk_score\": 73,\n    \"tags\": [\"OWASP-API1\", \"BOLA\", \"Enumeration\"]\n  }\n}\n```\n\n### Custom Detection Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"API Enumeration Attack Detector\n\nAnalyzes API access logs to detect enumeration patterns\nincluding BOLA, IDOR, and sequential ID probing.\n\"\"\"\n\nimport re\nimport sys\nimport json\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom dataclasses import dataclass, field\nfrom typing import List, Dict, Optional\n\n@dataclass\nclass AccessRecord:\n    timestamp: datetime\n    source_ip: str\n    user_id: Optional[str]\n    method: str\n    path: str\n    status_code: int\n    object_id: Optional[str] = None\n\n@dataclass\nclass EnumerationAlert:\n    source_ip: str\n    user_id: Optional[str]\n    endpoint_pattern: str\n    unique_object_ids: int\n    total_requests: int\n    time_window_seconds: float\n    requests_per_second: float\n    auth_failure_ratio: float\n    severity: str\n    attack_type: str\n    sample_ids: List[str] = field(default_factory=list)\n\nclass EnumerationDetector:\n    # Regex patterns for extracting object IDs from API paths\n    ID_PATTERNS = [\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F(\\d+)'),           # Numeric IDs\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F([a-f0-9\\-]{36})'), # UUIDs\n        re.compile(r'\u002Fapi\u002Fv\\d+\u002F(\\w+)\u002F([a-zA-Z0-9]{20,})'), # Long alphanumeric IDs\n    ]\n\n    def __init__(self, time_window_minutes: int = 5,\n                 min_unique_ids: int = 15,\n                 max_requests_per_second: float = 5.0):\n        self.time_window = timedelta(minutes=time_window_minutes)\n        self.min_unique_ids = min_unique_ids\n        self.max_rps = max_requests_per_second\n        self.access_log: List[AccessRecord] = []\n\n    def parse_log_line(self, line: str) -> Optional[AccessRecord]:\n        \"\"\"Parse a common log format line into an AccessRecord.\"\"\"\n        log_pattern = re.compile(\n            r'(?P\u003Cip>[\\d.]+)\\s+\\S+\\s+(?P\u003Cuser>\\S+)\\s+'\n            r'\\[(?P\u003Ctime>[^\\]]+)\\]\\s+'\n            r'\"(?P\u003Cmethod>\\w+)\\s+(?P\u003Cpath>\\S+)\\s+\\S+\"\\s+'\n            r'(?P\u003Cstatus>\\d+)'\n        )\n        match = log_pattern.match(line)\n        if not match:\n            return None\n\n        path = match.group('path')\n        object_id = None\n        for pattern in self.ID_PATTERNS:\n            id_match = pattern.search(path)\n            if id_match:\n                object_id = id_match.group(2)\n                break\n\n        return AccessRecord(\n            timestamp=datetime.strptime(match.group('time'), '%d\u002F%b\u002F%Y:%H:%M:%S %z'),\n            source_ip=match.group('ip'),\n            user_id=match.group('user') if match.group('user') != '-' else None,\n            method=match.group('method'),\n            path=path,\n            status_code=int(match.group('status')),\n            object_id=object_id\n        )\n\n    def analyze(self, records: List[AccessRecord]) -> List[EnumerationAlert]:\n        \"\"\"Analyze access records for enumeration patterns.\"\"\"\n        alerts = []\n\n        # Group by source IP and endpoint pattern\n        grouped = defaultdict(list)\n        for record in records:\n            if record.object_id:\n                # Normalize endpoint by removing the specific object ID\n                endpoint = re.sub(r'\u002F[a-f0-9\\-]{36}', '\u002F{id}',\n                         re.sub(r'\u002F\\d+', '\u002F{id}', record.path))\n                key = (record.source_ip, record.user_id, endpoint)\n                grouped[key].append(record)\n\n        for (src_ip, user_id, endpoint), records_group in grouped.items():\n            if len(records_group) \u003C self.min_unique_ids:\n                continue\n\n            # Sort by timestamp\n            records_group.sort(key=lambda r: r.timestamp)\n\n            # Analyze time windows\n            window_start = 0\n            for window_start in range(len(records_group)):\n                window_records = []\n                for r in records_group[window_start:]:\n                    if r.timestamp - records_group[window_start].timestamp \u003C= self.time_window:\n                        window_records.append(r)\n\n                unique_ids = set(r.object_id for r in window_records)\n                if len(unique_ids) \u003C self.min_unique_ids:\n                    continue\n\n                time_span = (window_records[-1].timestamp -\n                           window_records[0].timestamp).total_seconds()\n                rps = len(window_records) \u002F max(time_span, 1)\n\n                auth_failures = sum(1 for r in window_records\n                                   if r.status_code in (401, 403))\n                failure_ratio = auth_failures \u002F len(window_records)\n\n                # Determine severity\n                if len(unique_ids) > 100:\n                    severity = \"critical\"\n                elif len(unique_ids) > 50 or failure_ratio > 0.5:\n                    severity = \"high\"\n                elif len(unique_ids) > 20:\n                    severity = \"medium\"\n                else:\n                    severity = \"low\"\n\n                # Determine attack type\n                ids_list = sorted([r.object_id for r in window_records\n                                  if r.object_id and r.object_id.isdigit()])\n                is_sequential = self._check_sequential(ids_list)\n                attack_type = \"sequential_enumeration\" if is_sequential else \"random_enumeration\"\n\n                alert = EnumerationAlert(\n                    source_ip=src_ip,\n                    user_id=user_id,\n                    endpoint_pattern=endpoint,\n                    unique_object_ids=len(unique_ids),\n                    total_requests=len(window_records),\n                    time_window_seconds=time_span,\n                    requests_per_second=round(rps, 2),\n                    auth_failure_ratio=round(failure_ratio, 2),\n                    severity=severity,\n                    attack_type=attack_type,\n                    sample_ids=list(unique_ids)[:10]\n                )\n                alerts.append(alert)\n                break  # One alert per group\n\n        return alerts\n\n    def _check_sequential(self, ids: List[str]) -> bool:\n        \"\"\"Check if numeric IDs follow a sequential pattern.\"\"\"\n        if len(ids) \u003C 5:\n            return False\n        try:\n            numeric_ids = sorted(int(i) for i in ids)\n            sequential_count = sum(\n                1 for i in range(1, len(numeric_ids))\n                if numeric_ids[i] - numeric_ids[i-1] \u003C= 2\n            )\n            return sequential_count \u002F len(numeric_ids) > 0.7\n        except ValueError:\n            return False\n\n\ndef main():\n    detector = EnumerationDetector(\n        time_window_minutes=5,\n        min_unique_ids=15\n    )\n\n    log_file = sys.argv[1] if len(sys.argv) > 1 else \"\u002Fvar\u002Flog\u002Fapi\u002Faccess.log\"\n    records = []\n    with open(log_file, 'r') as f:\n        for line in f:\n            record = detector.parse_log_line(line.strip())\n            if record:\n                records.append(record)\n\n    alerts = detector.analyze(records)\n\n    if alerts:\n        print(f\"\\n[!] {len(alerts)} enumeration attack(s) detected:\\n\")\n        for alert in alerts:\n            print(f\"  Source IP: {alert.source_ip}\")\n            print(f\"  User ID: {alert.user_id}\")\n            print(f\"  Endpoint: {alert.endpoint_pattern}\")\n            print(f\"  Unique IDs Accessed: {alert.unique_object_ids}\")\n            print(f\"  Requests\u002Fsec: {alert.requests_per_second}\")\n            print(f\"  Auth Failure Ratio: {alert.auth_failure_ratio}\")\n            print(f\"  Attack Type: {alert.attack_type}\")\n            print(f\"  Severity: {alert.severity.upper()}\")\n            print(f\"  Sample IDs: {alert.sample_ids}\")\n            print()\n    else:\n        print(\"[+] No enumeration attacks detected.\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## Prevention Controls\n\n### Server-Side Authorization Enforcement\n\n```python\n# Always validate object ownership at the data layer\ndef get_user_order(request, order_id):\n    order = Order.objects.get(id=order_id)\n    if order.user_id != request.user.id:\n        raise PermissionDenied(\"Not authorized to access this order\")\n    return order\n```\n\n### Use Unpredictable Identifiers\n\n```python\nimport uuid\n\n# Use UUIDs instead of sequential integers\nclass Order(Model):\n    id = UUIDField(default=uuid.uuid4, primary_key=True)\n```\n\n### Implement Rate Limiting Per Endpoint\n\n```yaml\n# Kong rate limiting per API route\nplugins:\n  - name: rate-limiting\n    config:\n      minute: 30\n      policy: redis\n      limit_by: credential\n```\n\n## References\n\n- OWASP API1:2023 Broken Object Level Authorization: https:\u002F\u002Fowasp.org\u002FAPI-Security\u002Feditions\u002F2023\u002Fen\u002F0xa1-broken-object-level-authorization\u002F\n- Traceable.ai BOLA Deep Dive: https:\u002F\u002Fwww.traceable.ai\u002Fblog-post\u002Fa-deep-dive-on-the-most-critical-api-vulnerability----bola-broken-object-level-authorization\n- Cequence BOLA Prevention: https:\u002F\u002Fwww.cequence.ai\u002Fsolutions\u002Fbola-and-enumeration-attack-prevention\u002F\n- Cloudflare API Shield BOLA Detection: https:\u002F\u002Fcommunity.cloudflare.com\u002Ft\u002Fapi-shield-new-bola-vulnerability-detection-for-api-shield\u002F883021\n- Sycope IDOR Detection via HTTP Traffic Analysis: https:\u002F\u002Fwww.sycope.com\u002Fpost\u002Fidor-vulnerability-how-to-detect-an-attack-on-web-applications-through-http-traffic-analysis\n",{"name":5,"tags":54,"author":58,"domain":47,"license":15,"version":59,"nist_csf":60,"subdomain":30,"description":7,"mitre_attack":65},[30,34,33,32,31,55,56,57],"owasp-api-top-10","access-control","rate-limiting","mahipal","1.0",[61,62,63,64],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[66,67,68,69,70],"T1595","T1595.002","T1046","T1190","T1087","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-api-enumeration-attacks",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-api-enumeration-attacks",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-api-enumeration-attacks",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-api-enumeration-attacks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-api-enumeration-attacks\u002FSKILL.md",true,[95,100,106,110,114,118],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-api-enumeration-attacks\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1931,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-api-enumeration-attacks\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002FCALLOUTS.md",1238,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fobsidian-markdown\u002Freferences\u002FCALLOUTS.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002FEMBEDS.md",780,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fobsidian-markdown\u002Freferences\u002FEMBEDS.md",{"path":115,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002FPROPERTIES.md",1149,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fobsidian-markdown\u002Freferences\u002FPROPERTIES.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",6726,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-api-enumeration-attacks\u002Fscripts\u002Fagent.py",[125,152,176,203,228,255],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":134,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[135,136,137,138,48,47,139,140,45,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[160,148,161,162,48,163,47,45,164,165,166,167,168,169,170,171,172,173,174,175],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[182,185],{"categoryNo":183,"categoryName":184,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[170,187,188,189,190,47,191,192,164,193,194,195,196,197,35,198,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,47,214,215,41,216,217,218,219,220,221,222,223,224,167,225,226,227],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,47,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},[48,263,47,46,264,265,266,267,268,269,270,198,271,199,272,273,274,275,276,277],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]