2026-08-04 06:09:22 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 该文档介绍了一款名为API-Pentest的API渗透测试工具，其核心思路是结合浏览器登录、Katana爬虫、JSSourceMap分析和AIAgent智能分析，实现API端点的自动提取、参数补全和隐藏端点发现。工具支持Agent模式（无需APIKey）、外部LLM模式和仅规则模式，并集成了未授权访问、越权及SQL注入测试，最终生成自动化报告。该工具为安全测试人员提供了一套系统化的API安全评估方案。 综合评分： 87 文章分类： 安全工具,渗透测试,WEB安全,红队

cover_image

API-Pentest — 基于 JS 分析 + AI Agent 的 API 渗透测试工具

XHSEC01 XHSEC01

知微守望

2026年8月3日 14:30 北京

在小说阅读器读本章

去阅读

思路

浏览器登录 → Katana 爬虫 → 数据清洗 → JS Source Map 提炼 API →AI Agent 智能分析补全参数 + 发现隐藏端点→ 接口未授权测试 → 越权测试 → SQL 注入测试 → 报告产出

核心特性

#

无需 API Key：AI Agent（你对话的 AI）直接分析 API，不需要配置任何外部模型
Katana 爬虫：原生支持 JS 渲染，解决 SPA 应用爬取难题
JS Source Map 分析：自动从 JS 文件中提取 API 端点和参数定义
三层参数补全：JS 提取 → 规则推断 → AI Agent 分析，逐层增强
系统化测试：基于增强后的完整 API 列表进行批量测试
自动化报告：生成 JSON 和 HTML 格式的渗透测试报告

环境要求

#

Python 3.10+
Katana 1.6+
Playwright + Chromium

安装依赖

#

pip&nbsp;install httpx playwright chardet charset-normalizerplaywright install chromium

#

快速开始（Agent 模式，无需 API Key）

Step 1: 爬虫 + JS 分析 + 生成 Agent prompt

python&nbsp;main.py&nbsp;--target&nbsp;https://example.com --agent

执行流程：

弹出浏览器，手动登录
Katana 爬虫爬取
数据清洗
JS 文件分析提取 API 端点
规则引擎增强参数
生成workspace/agent_prompt.json（结构化 prompt）
停止，等待 AI Agent 分析

Step 2: AI Agent 分析

AI Agent（你对话的 AI）会：

读取workspace/agent_prompt.json
分析每个 API 端点的业务语义
推断 JS 中未出现的隐藏参数
发现规则引擎未覆盖的隐藏端点
将分析结果写入workspace/llm_analysis.json

Step 3: 合并结果 + 执行测试 + 生成报告

python main.py --target https://example.com --merge-llm workspace/llm_analysis.json --skip-crawl --skip-login

执行流程：

合并 Agent 分析结果到js_apis_enhanced.json
未授权访问测试
越权测试
SQL 注入测试
生成报告

三种分析模式对比

| | | | | | | — | — | — | — | — | | 模式 | 命令参数 | 需要 API Key | 分析质量 | 说明 | | Agent 模式 | –agent | ❌ 不需要 | ⭐⭐⭐⭐⭐ | AI Agent 直接分析，推荐 | | 外部 LLM 模式 | –llm | ✅ 需要 | ⭐⭐⭐⭐ | 调用 OpenAI/DeepSeek 等 | | 仅规则模式 | 默认 | ❌ 不需要 | ⭐⭐⭐ | 内置规则引擎推断 |

分析架构

JS 提取的 API (js_apis.json)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼┌─────────────────────────────────────────────────┐│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 三层参数补全引擎 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp;Layer 1: JS 提取参数 (source=js_extracted) &nbsp; &nbsp; &nbsp;││ &nbsp;Layer 2: 规则推断参数 (source=rule:*) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp;Layer 3: Agent 分析参数 (source=agent_inferred) &nbsp;││ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ││ &nbsp;优先级: JS > Agent > 规则 (去重合并) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │└─────────────────────────────────────────────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼&nbsp; 参数增强后的端点 &nbsp; &nbsp; &nbsp;隐藏端点发现&nbsp; (含 test_value) &nbsp; &nbsp; (CRUD 同族 + Agent 推断)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;└────────┬───────────┘&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼&nbsp; &nbsp; &nbsp;js_apis_enhanced.json&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;┌────────┼────────┐&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp;▼ &nbsp; &nbsp; &nbsp; &nbsp;▼&nbsp; &nbsp; 未授权测试 &nbsp;越权测试 &nbsp;SQL注入

Agent 模式工作流

main.py&nbsp;--agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;main.py&nbsp;--merge-llm&nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼┌───────────┐ &nbsp; &nbsp;AI Agent &nbsp; &nbsp; &nbsp; &nbsp;┌──────────────┐│ 规则引擎 &nbsp; │ &nbsp; &nbsp;读取分析 &nbsp; &nbsp; &nbsp; &nbsp;│ 合并 Agent &nbsp; &nbsp;││ 增强 &nbsp; &nbsp; &nbsp;│ ──────────────→ &nbsp; │ 分析结果 &nbsp; &nbsp; &nbsp;││ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp;写出结果 &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ 生成 &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ 生成 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;││ prompt &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ enhanced.json&nbsp;│└───────────┘ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; └──────────────┘&nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼agent_prompt.json&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; js_apis_enhanced.json&nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; &nbsp; &nbsp; │ &nbsp;AI Agent 读取 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ 后续测试使用&nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼llm_analysis.json&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 未授权/越权/SQL注入

分步执行

# Phase 1: 浏览器登录python scripts/extract_credentials.py --url https://example.com --output workspace/sessions/credentials.json# Phase 2: Katana 爬虫python scripts/run_katana.py --target https://example.com# Phase 3: 数据清洗python scripts/clean_targets.py# Phase 4: JS API 提取python scripts/extract_js_apis.py --targets workspace/targets.txt --output workspace/js_apis.json# Phase 4.5a: Agent 模式 — 生成 promptpython scripts/llm_analyze_apis.py --input workspace/js_apis.json --agent# [AI Agent 读取 agent_prompt.json，分析后写出 llm_analysis.json]# Phase 4.5b: 合并 Agent 分析结果python scripts/llm_analyze_apis.py --input workspace/js_apis.json --merge workspace/llm_analysis.json# Phase 5-7: 测试python scripts/test_unauth.py --apis workspace/js_apis_enhanced.jsonpython scripts/test_idor.py --apis workspace/js_apis_enhanced.json --sessions workspace/sessions/python scripts/test_sqli.py --apis workspace/js_apis_enhanced.json --sessions workspace/sessions/# Phase 8: 报告python scripts/generate_report.py --workspace workspace --target-url https://example.com

配置

编辑config.py：

项目结构

api-pentest/├── main.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 主编排器（支持 --agent/--merge-llm/--llm）├── config.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 全局配置├── scripts/│ &nbsp; ├── extract_credentials.py &nbsp; &nbsp; &nbsp;# 浏览器登录提取凭证│ &nbsp; ├── run_katana.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Katana 爬虫│ &nbsp; ├── clean_targets.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 数据清洗│ &nbsp; ├── extract_js_apis.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# JS Source Map 分析提取 API│ &nbsp; ├── llm_analyze_apis.py &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# API 智能分析（Agent/LLM/规则三模式）│ &nbsp; ├── test_unauth.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 未授权测试│ &nbsp; ├── test_idor.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 越权测试│ &nbsp; ├── test_sqli.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# SQL 注入测试│ &nbsp; ├── generate_report.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 报告生成│ &nbsp; └── http_test.py &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# HTTP 发包工具├── workspace/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 工作目录│ &nbsp; ├── sessions/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 凭证│ &nbsp; ├── crawl/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 爬虫输出│ &nbsp; ├── js_files/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# JS 文件│ &nbsp; ├── findings/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 测试结果│ &nbsp; ├── js_apis.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# JS 提取的 API│ &nbsp; ├── agent_prompt.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Agent 分析 prompt（--agent 生成）│ &nbsp; ├── llm_analysis.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Agent 分析结果（AI 写出）│ &nbsp; ├── js_apis_enhanced.json &nbsp; &nbsp; &nbsp;&nbsp;# 增强后的 API（合并后）│ &nbsp; └── report_*.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 最终报告└── templates/

agent_prompt.json 结构

{&nbsp; "instructions": {&nbsp; &nbsp; "role":&nbsp;"你是资深 Web 安全专家和 API 逆向工程师",&nbsp; &nbsp;&nbsp;"task":&nbsp;"分析 API 端点，补全隐藏参数并发现未提取的端点",&nbsp; &nbsp;&nbsp;"requirements": ["1. 推断隐藏参数",&nbsp;"2. 发现隐藏端点", ...]&nbsp; },&nbsp; "target":&nbsp;"https://example.com",&nbsp;&nbsp;"endpoint_groups": {&nbsp; &nbsp; "role": [&nbsp; &nbsp; &nbsp; {"path":&nbsp;"/role/page",&nbsp;"method":&nbsp;"POST",&nbsp;"js_params": [...],&nbsp;"rule_inferred_params": [...]}&nbsp; &nbsp; ]&nbsp; },&nbsp; "rule_inferred_hidden_endpoints": [...],&nbsp;&nbsp;"output_format": {&nbsp; &nbsp; "schema": {&nbsp; &nbsp; &nbsp; "analyzed_endpoints": [{"path":&nbsp;"...",&nbsp;"inferred_params": [...]}],&nbsp; &nbsp; &nbsp; "hidden_endpoints": [{"path":&nbsp;"...",&nbsp;"params": [...]}]&nbsp; &nbsp; },&nbsp; &nbsp; "output_file":&nbsp;"workspace/llm_analysis.json"&nbsp; }}

llm_analysis.json 结构（AI Agent 写出）

{&nbsp; "analyzed_endpoints": [&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; "path":&nbsp;"/role/page",&nbsp; &nbsp; &nbsp;&nbsp;"method":&nbsp;"POST",&nbsp; &nbsp; &nbsp;&nbsp;"inferred_params": [&nbsp; &nbsp; &nbsp; &nbsp; {"name":&nbsp;"roleName",&nbsp;"type":&nbsp;"string",&nbsp;"test_value":&nbsp;"admin",&nbsp;"reason":&nbsp;"角色名筛选"}&nbsp; &nbsp; &nbsp; ],&nbsp; &nbsp; &nbsp; "risk":&nbsp;"medium",&nbsp; &nbsp; &nbsp;&nbsp;"notes":&nbsp;"分页查询接口，可能支持模糊搜索"&nbsp; &nbsp; }&nbsp; ],&nbsp; "hidden_endpoints": [&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; "path":&nbsp;"/role/export",&nbsp; &nbsp; &nbsp;&nbsp;"method":&nbsp;"POST",&nbsp; &nbsp; &nbsp;&nbsp;"params": [{"name":&nbsp;"format",&nbsp;"type":&nbsp;"string",&nbsp;"test_value":&nbsp;"xlsx"}],&nbsp; &nbsp; &nbsp; "risk":&nbsp;"medium",&nbsp; &nbsp; &nbsp;&nbsp;"reason":&nbsp;"基于 /role/page 推断存在导出接口"&nbsp; &nbsp; }&nbsp; ]}

参考链接

https://github.com/XHSEC01/API-PENTEST

多大神卧虎藏龙、开源分享。作为初学者，我们可能有差距，不论你之前是什么方向，是什么工作，是什么学历，是大学大专中专，亦或是高中初中，只要你喜欢安全，喜欢渗透，就朝着这个目标去努力吧！有差距不可怕，我们需要的是去缩小差距，去战斗，况且这个学习的历程真的很美，安全真的有意思。但切勿去做坏事，我们需要的是白帽子，是维护我们的网络，安全路上共勉。

本文版权归作者和微信公众号平台共有，重在学习交流，不以任何盈利为目的，欢迎转载。

由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，文章作者不为此承担任何责任。公众号内容中部分攻防技巧等只允许在目标授权的情况下进行使用，大部分文章来自各大安全社区，个人博客，如有侵权请立即联系公众号进行删除。若不同意以上警告信息请立即退出浏览！！！

敲敲小黑板：《刑法》第二百八十五条　【非法侵入计算机信息系统罪；非法获取计算机信息系统数据、非法控制计算机信息系统罪】违反国家规定，侵入国家事务、国防建设、尖端科学技术领域的计算机信息系统的，处三年以下有期徒刑或者拘役。违反国家规定，侵入前款规定以外的计算机信息系统或者采用其他技术手段，获取该计算机信息系统中存储、处理或者传输的数据，或者对该计算机信息系统实施非法控制，情节严重的，处三年以下有期徒刑或者拘役，并处或者单处罚金；情节特别严重的，处三年以上七年以下有期徒刑，并处罚金。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：知微守望 XHSEC01 XHSEC01《API-Pentest — 基于 JS 分析 + AI Agent 的 API 渗透测试工具》