API-Security-Scanner/test-openapi-config.yaml at master · elliotsecops/API-Security-Scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
api_endpoints:
  - url: "https://httpbin.org/status/200"
    method: "GET"

auth:
  username: "testuser"
  password: "testpass"

injection_payloads:
  - "' OR '1'='1"
  - "'; DROP TABLE users;--"

xss_payloads:
  - "<script>alert('XSS')</script>"
  - "'><script>alert('XSS')</script>"

# Phase 3: NoSQL injection payloads
nosql_payloads:
  - "{$ne: null}"
  - "{$gt: ''}"

# Phase 3: OpenAPI specification path
openapi_spec: "test-openapi.yaml"

# Phase 3: API discovery configuration
api_discovery:
  enabled: true
  max_depth: 2
  follow_links: true
  discover_params: true
  user_agent: "API-Security-Scanner-Discovery/1.0"
  exclude_patterns:
    - "/static/"
    - "/assets/"

# Phase 3: Historical data configuration
historical_data:
  enabled: true
  storage_path: "./test-history"
  retention_days: 30
  compare_previous: true
  trend_analysis: true

headers:
  "User-Agent": "API-Security-Scanner/1.0"

rate_limiting:
  requests_per_second: 5
  max_concurrent_requests: 3