Wiki / Exploitation / Siphon

Siphon

Exploitation v2.34.6 — Multi-phase API pentest orchestrator — OWASP API Top 10 2023 coverage: BOLA, BFLA, mass assignment, JWT attacks, rate limit bypass, and data exposure testing.
7
Dependencies
22
Phases
168
Catalogue Findings
SI
Finding Prefix

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Siphon is an API penetration testing orchestrator that performs comprehensive security assessments against REST, GraphQL, SOAP/WS-Security, WebSocket, SSE, and gRPC APIs. It drives a 22-phase testing pipeline aligned to the OWASP API Security Top 10 2023, combining built-in Python testing logic with external discovery tools (Kiterunner, FFUF, Feroxbuster, dirsearch, Katana) to cover both documented and undocumented API endpoints.

The assessment begins with Phase 0 — OpenAPI/Swagger specification discovery and endpoint enumeration using multiple brute-forcing tools. If the API has a spec file (OpenAPI, Swagger, GraphQL, Postman, Insomnia, HAR), Siphon parses it to extract every endpoint, parameter, and schema definition; undocumented endpoints discovered by the discovery tools are flagged as potential rogue endpoints. A request chaining engine (Phase 0c) supports ordered execution with automatic value capture (IDs, tokens) for stateful API coverage. Wildcard/catch-all detection prevents false positives by identifying APIs that respond identically to all paths — when detected, brute-forcing (Phase 0) and fuzzing (Phase 2) phases are skipped entirely.

Testing progresses through API fingerprinting and framework detection, HTTP method fuzzing with parameter fuzzing, multi-vector injection attacks (SQLi, NoSQLi, SSTI, XXE, LDAP, XSS, CMDi, CRLF, path traversal), JWT algorithm confusion attacks, user enumeration via response differential analysis, rate limiting bypass, mass assignment, SSRF, excessive data exposure analysis, GraphQL introspection and query depth testing, and business flow abuse (workflow skip, race conditions, value manipulation). Authenticated phases test BOLA/IDOR, BFLA, cross-user data leakage, advanced JWT attacks (jku, kid injection, HMAC cracking), session/token management, and multi-credential access matrices. Siphon also covers SOAP/WS-Security (WSDL enumeration, WS-Security bypass, SOAP injection), HTTP verb tampering, sensitive file exposure, TLS/SSL analysis, unsafe API consumption patterns (webhook SSRF, open redirect, deserialization), file upload endpoint detection, and non-HTTP protocol testing (WebSocket, SSE, gRPC).

Siphon implements a mandatory environment gate: the operator must declare production vs. non-production. Production mode restricts testing to read-only operations (no write-method state changes, no business-flow/mass-assignment tests). The tool features adaptive concurrency with hardware-aware scaling (CPU/RAM monitoring daemon adjusts thread pool in real time), per-subprocess 2 GB memory limits, and an OOM watchdog that kills the largest tracked subprocess when system memory exceeds 90%. A checkpoint/resume system persists completed phases to checkpoint.json for scan resumption after interruption.

All findings are auto-mapped to the OWASP API Security Top 10 2023 categories with CVE enrichment from title keywords. Output follows the pr0t31n universal directory structure with findings.json, findings.csv, api_inventory.json, api_map.json, summary.json, authentication_status.json, and per-phase evidence files with .log siblings. When running under Crucible (CRUCIBLE_MANAGED=1), Siphon emits __CRUCIBLE_LOG__, __CRUCIBLE_ERR__, __CRUCIBLE_STATUS__, and __CRUCIBLE_ACTION_ITEM__ protocol tokens. Pause/resume is supported via the shared pr0t31n_pause module.

Phase Pipeline

  1. Phase 0 — OpenAPI/Swagger discovery + Kiterunner/FFUF/Feroxbuster/dirsearch
  2. Phase 1 — API fingerprinting, server headers, CORS, framework detection
  3. Phase 2 — HTTP method fuzzing, FFUF parameter fuzzing
  4. Phase 3 — SQLi, NoSQLi, SSTI, XXE, LDAP, XSS, CMDi, CRLF, Path Traversal
  5. Phase 4 — JWT algorithm confusion, none-alg, key confusion
  6. Phase 5 — Rate limit detection and bypass techniques
  7. Phase 6 — Mass assignment / over-posting attack testing
  8. Phase 7 — SSRF via API URL parameters
  9. Phase 8 — Excessive data exposure in API responses
  10. Phase 9 — GraphQL introspection and query fuzzing
  11. Phase 10 — BOLA/IDOR — cross-user object access (auth required)
  12. Phase 11 — BFLA — function-level authorization bypass (auth required)
  13. Phase 12 — Cross-user data leakage (auth + auth2 required)
  14. Phase 13 — API session / token management analysis (auth required)
  15. Phase 14 — JWT advanced attacks — jku, kid, HMAC cracking (auth required)
  16. Phase 15 — Sensitive file exposure — .env, config, git, swagger (API9)
  17. Phase 16 — TLS/SSL analysis — deprecated protocols, weak ciphers (API8)
  18. Phase 17 — HTTP verb tampering — method override header bypass
  19. Phase 18 — SOAP/WS-Security — WSDL enum, WS-Security bypass, SOAP injection
  20. Phase 19 — File upload endpoint detection — accepted types (informational)
  21. Phase 20 — Multi-credential access matrix — per-role endpoint access, BFLA, unauthenticated access
  22. Phase 21 — Non-HTTP protocols — WebSocket / SSE / gRPC detection + passive checks

Security

Siphon enforces a mandatory environment declaration (production vs. non-production) before any testing begins. In production mode, write-method state changes and destructive tests (business-flow abuse, mass assignment) are disabled to prevent unintended data modification. SSL certificate verification is intentionally disabled (verify=False) by default since the tool must probe self-signed and internal APIs, but a verify_ssl setting can re-enable it. Per-subprocess memory limits (2 GB virtual address space cap via RLIMIT_AS) and an OOM watchdog daemon prevent runaway child processes from exhausting system resources. Authentication credentials are never logged to findings output — only authentication status is recorded in authentication_status.json. The pause manager integrates with Crucible's process control, allowing graceful interruption with a configurable grace period.

Features

Advanced

SSRF via API Parameters
Phase 7 -- Server-Side Request Forgery testing through URL parameters, webhook URLs, and redirect fields (API7:2023).
GraphQL Testing
Phase 9 -- GraphQL introspection analysis, query depth/complexity testing, batch query abuse, and field-level authorization checks.
Business Flow Abuse
Phase 9b -- Workflow skip, race conditions, value manipulation, and business logic bypass attacks (API6:2023 -- Unrestricted Access to Sensitive Business Flows).
Unsafe API Consumption
Phase 16b -- Webhook SSRF, open redirect via API responses, and insecure deserialization in API consumption patterns (API10:2023).
SOAP / WS-Security Testing
Phase 18 -- WSDL enumeration, WS-Security bypass, SOAP injection, and XML signature verification testing.
HTTP Verb Tampering
Phase 17 -- Method override header bypass (X-HTTP-Method-Override, X-Method-Override) for access control circumvention.
File Upload Endpoint Detection
Phase 19 -- Detects file upload endpoints and enumerates accepted content types (informational phase for follow-up manual testing).
Sensitive File Exposure
Phase 15 -- Probes for exposed sensitive files: .env, config files, git metadata, Swagger/OpenAPI specs, and other developer artifacts (API9:2023).

Authentication

JWT Attack Suite
Phase 4 + Phase 14 -- JWT algorithm confusion (none-alg, RS256-to-HS256), key confusion, jku/x5u injection, kid path traversal, and HMAC key brute-forcing.
User Enumeration Detection
Phase 4b -- Detects user enumeration via response differential analysis: status code differential and timing differential on authentication endpoints.
Default API Credential Testing
Probes for default credentials against detected API frameworks and common admin endpoints.
Comprehensive Auth Method Support
Supports 25+ authentication methods: Bearer, JWT Bearer, Basic, Digest, NTLM, NTLMv2, Kerberos, Kerberos Delegation, OAuth2 Client Credentials, OAuth2 Password, OAuth 1.0a, OIDC Token, SAML Assertion, Mutual TLS (mTLS), TOTP MFA, API Key (header/query), API Key Cookie, Cookie Login, Session Cookie, Form Login, Token Login, HMAC Signature, AWS SigV4, and custom header credentials.
Session / Token Management Analysis
Phase 13 -- Analyzes API session management: token expiration, rotation, invalidation, and fixation vulnerabilities.

Authorization

BOLA / IDOR Testing
Phase 10 -- Broken Object Level Authorization testing: cross-user object access using manipulated identifiers (API1:2023). Requires authenticated session.
BFLA Testing
Phase 11 -- Broken Function Level Authorization: accessing admin/privileged functions with lower-privilege credentials (API5:2023). Requires authenticated session.
Multi-Credential Access Matrix
Phase 20 -- Systematic per-role endpoint access verification, unauthenticated access testing, and BFLA detection across all discovered endpoints using multiple credential sets.

Data

Mass Assignment Testing
Phase 6 -- Tests for over-posting / mass assignment vulnerabilities by injecting additional fields into API requests (API3:2023).
Excessive Data Exposure
Phase 8 -- Analyses API responses for sensitive data leakage (PII, internal IDs, debug information) beyond what the client should receive (API3:2023).
Cross-User Data Leakage
Phase 12 -- Tests data segregation between authenticated users to detect information disclosure across accounts. Requires two authenticated sessions (auth + auth2).

Discovery

OpenAPI / Swagger Discovery
Phase 0 -- Automatic detection and parsing of OpenAPI 2.0/3.x specifications, GraphQL schemas, Postman collections, Insomnia exports, and HAR files to extract endpoints, parameters, schemas, and authentication requirements.
Multi-Tool Endpoint Enumeration
Phase 0 -- Kiterunner, FFUF, Feroxbuster, dirsearch, and Katana integration for discovering undocumented API endpoints beyond what the specification declares.
Rogue Endpoint Detection
Endpoints discovered by brute-forcing tools but absent from the API specification are flagged as potential rogue/shadow endpoints (API9:2023 -- Improper Inventory Management).
Request Chaining Engine
Phase 0c -- Ordered request execution with automatic value capture (IDs, tokens, session data) for testing stateful API workflows where later requests depend on earlier responses.
Wildcard / Catch-All Detection
Detects APIs that respond identically to all paths using multi-signal body fingerprinting (hash, word count, line count, body length, SequenceMatcher similarity). Skips brute-forcing and fuzzing phases to prevent false positive floods.
HTTP Method Probing
Phase 0 -- Probes tool-discovered paths with OPTIONS and per-method fallback to map which HTTP methods each endpoint actually supports.

Fuzzing

HTTP Method Fuzzing
Phase 2 -- Tests all HTTP methods (GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD, TRACE) against discovered endpoints.
Parameter Fuzzing via FFUF
Phase 2 -- Uses FFUF to fuzz query and body parameters on discovered endpoints for hidden parameters and injection points.

Injection

Multi-Vector Injection
Phase 3 -- SQL injection, NoSQL injection, SSTI (Server-Side Template Injection), XXE, LDAP injection, XSS, command injection, CRLF injection, and path traversal testing across all parameters.

Output

OWASP API Top 10 Auto-Mapping
Every non-INFO finding is automatically mapped to the relevant OWASP API Security Top 10 2023 category (API1 through API10) with a URL reference to the OWASP page.
CVE Enrichment
Automatic CVE association based on title keyword matching for known vulnerability patterns (JWT flaws, Heartbleed, Log4Shell, Spring4Shell, Struts, POODLE, BEAST, DROWN, FREAK, Logjam, Sweet32, etc.).
Authentication Status Recording
Records per-role authentication state to authentication_status.json including cookies, auth headers, landing URL/code/body for Crucible consumption.

Performance

Adaptive Concurrency
Hardware-aware thread pool that detects CPU count and RAM, calculates initial concurrency (75% of logical CPUs, bounded by RAM at 0.25 GB per worker, clamped to 4-64), and runs a daemon thread that samples CPU/RAM every 10 seconds to scale parallelism up or down.
OOM Watchdog
Background daemon that monitors system memory and kills the largest tracked subprocess when usage exceeds 90%, preventing system-wide out-of-memory conditions.
Per-Subprocess Memory Limits
Each spawned child process is capped at 2 GB virtual address space via RLIMIT_AS preexec_fn to prevent individual tool invocations from exhausting system memory.

Protocols

WebSocket / SSE / gRPC Detection
Phase 21 -- Detects and performs passive checks on non-HTTP protocol endpoints: WebSocket upgrade negotiation, Server-Sent Events streams, and gRPC service reflection via grpcurl.

Rate Limiting

Rate Limit Detection and Bypass
Phase 5 -- Identifies rate limiting mechanisms and tests bypass techniques (header rotation, IP spoofing headers, path manipulation).

Reconnaissance

API Framework Fingerprinting
Phase 1 -- Identifies the underlying API framework (Express, Flask, Django REST, FastAPI, Spring Boot, Gin, etc.) from response headers and error patterns.
CORS Analysis
Phase 1 -- Tests Cross-Origin Resource Sharing configuration for overly permissive or wildcard origins.
Security Header Analysis
Phase 1 -- Checks for missing or misconfigured security headers across all discovered endpoints.

Resilience

Checkpoint / Resume
Phase completion state persisted to checkpoint.json for scan resumption after interruption. Resume via --resume flag or CRUCIBLE_RESUME=1 environment variable.
Pause / Resume Support
Integrates with Crucible's pause manager (pr0t31n_pause) for graceful interruption with a configurable grace period. Pause checks are inserted between phases.

TLS

TLS/SSL Analysis
Phase 16 -- Deprecated protocol detection, weak cipher identification, and certificate validation using sslscan and testssl.sh (API8:2023 -- Security Misconfiguration). False-positive filtering aligned with Fracture's parser.

Use Cases

OWASP API Top 10 Assessment

Systematically test a REST API against all 10 categories of the OWASP API Security Top 10 2023, generating evidence-backed findings with compliance mappings and OWASP category references.

API Spec vs. Reality Audit

Compare a published OpenAPI specification against the actual API surface -- discover undocumented (rogue) endpoints, hidden parameters, and shadow functionality that the specification does not declare.

JWT Security Assessment

Comprehensively test JWT-based authentication: algorithm confusion (none-alg, RS256-to-HS256), key confusion, jku/x5u injection, kid path traversal, and HMAC key cracking.

Microservices API Gateway Testing

Test rate limiting enforcement, CORS configuration, and authorization boundaries across microservice API endpoints behind a gateway.

Multi-Role Authorization Testing

Provide credentials for multiple roles (admin, user, viewer) to build a complete access matrix (Phase 20) and identify BOLA, BFLA, and privilege escalation paths across all endpoints.

SOAP / Legacy API Security Review

Assess SOAP-based APIs and WS-Security implementations for WSDL exposure, XML injection, and authentication bypass vulnerabilities.

GraphQL API Penetration Test

Test GraphQL endpoints for introspection exposure, query depth/complexity abuse, batch query attacks, and field-level authorization failures.

Production API Safety Audit

Run Siphon in production mode (--environment production) for read-only testing that avoids state-changing operations while still covering reconnaissance, authentication, TLS, rate limiting, and data exposure analysis.

CLI Reference

Command Examples

Run with Settings

python3 siphon.py --settings settings.json

Run full API assessment with settings specifying base URL, OpenAPI spec, and auth tokens.

Generate Template

python3 siphon.py --init-settings

Create a template settings.json.

Resume

python3 siphon.py --settings settings.json --resume

Resume from the last checkpoint.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

kiterunner (kr)
API endpoint discovery using curated API-specific wordlists. Run during Phase 0 discovery when the kr binary is found on PATH.
kr scan <url> -w routes-large.kite --fail-status-codes 400,401,403,404,500
ffuf
High-speed HTTP fuzzing for endpoint discovery (Phase 0) and parameter fuzzing (Phase 2). Supports auth header passthrough.
ffuf -u <url>/FUZZ -w <wordlist> -mc 200,301,302,403 -o <output>.json -of json
ffuf -u <url>?FUZZ=test -w <param-wordlist> -mc 200 -o <output>.json -of json
feroxbuster
Recursive content discovery and directory brute-forcing during Phase 0 discovery.
feroxbuster -u <url> -w <wordlist> --depth 2 -o <output>.txt --no-state
dirsearch
URL path brute-forcing with extension detection during Phase 0 discovery.
dirsearch -u <url> -e json,xml,yaml -o <output>.json --format json
katana
Web crawler from ProjectDiscovery for discovering API endpoints through link extraction and JavaScript parsing during Phase 0.
katana -u <url> -d 3 -jc -o <output>.jsonl -jsonl
sslscan
SSL/TLS cipher enumeration for API endpoints during Phase 16 TLS analysis.
sslscan --no-colour <host>:<port>
testssl.sh
Comprehensive TLS protocol and cipher analysis for API transport security during Phase 16.
testssl.sh --fast --quiet <host>:<port>
grpcurl
gRPC service reflection and method listing during Phase 21 protocol detection.
grpcurl -plaintext <host>:<port> list

Finding Nomenclature

Siphon findings use the SI- prefix in the findings catalogue (e.g., SI-001, SI-002). Each finding includes:

  • Catalogue ID — Unique identifier mapped to a specific API vulnerability detection pattern
  • OWASP API Mapping — Automatic mapping to the OWASP API Security Top 10 2023 category (API1:2023 through API10:2023) with a URL reference to the relevant OWASP page. The auto-mapper uses keyword matching against finding titles to assign the most appropriate category.
  • Risk Level — CRITICAL, HIGH, MEDIUM, LOW, or INFO (always uppercase)
  • API Context — The specific endpoint path, HTTP method, and whether the endpoint was from the API spec or discovered via brute-forcing (rogue endpoint flag)
  • Evidence Files — Request/response captures, tool output, and .log transcripts under evidence/ and tool-specific directories
  • CVE Enrichment — Automatic CVE association based on title keyword matching for known vulnerability patterns (JWT flaws, TLS vulnerabilities, framework-specific CVEs)

Key finding categories mapped to OWASP API Top 10 2023:

  • API1 — BOLA/IDOR, cross-user object access, insecure direct object references
  • API2 — JWT flaws, broken authentication, credential weaknesses, token management issues
  • API3 — Excessive data exposure, mass assignment, object property level authorization failures
  • API4 — Rate limiting absence, unrestricted resource consumption
  • API5 — BFLA, function-level authorization bypass, unauthorized HTTP methods
  • API6 — Business flow abuse, workflow skip, race conditions
  • API7 — SSRF, open redirect
  • API8 — Security misconfiguration (injections, headers, CORS, TLS, framework exposure)
  • API9 — Improper inventory management, rogue endpoints, sensitive file exposure, wildcard routing
  • API10 — Unsafe API consumption, webhook SSRF, supply chain

Action Items

Siphon generates action items emitted as __CRUCIBLE_ACTION_ITEM__ protocol tokens for display in the Crucible management console and persisted to action_items.json in the output directory. Each action item includes a unique ID, type, recommended tool, target, priority, and description. The recommended tools include:

  • fracture — Follow-up web application testing for findings that indicate broader web vulnerabilities beyond the API surface (e.g., injection findings that warrant deeper exploitation testing, endpoints needing full web app assessment)
  • isotope — Cryptographic analysis follow-up for JWT key material, TLS configuration anomalies, or certificate chain issues
  • Manual Verification — Findings that require human judgment, domain knowledge, or multi-step manual testing

Common action item scenarios:

  • Rogue endpoint discovery — undocumented endpoints found via brute-forcing that are not in the API specification and need manual review for sensitivity and access control
  • Potential BOLA/IDOR candidates — object identifiers that appear to be incrementable or predictable, requiring cross-user verification with a second credential set
  • JWT implementation anomalies — cases where the JWT validation behaviour is ambiguous (e.g., accepts both RS256 and HS256 but key confusion exploit did not fully succeed)
  • Rate limiting gaps — specific endpoints that lack rate limiting where business logic suggests they should have it (e.g., login, password reset, payment endpoints)
  • Business flow abuse leads — workflow steps that can be skipped or reordered but require domain knowledge to assess the business impact
  • Injection indicators that warrant deeper exploitation with Fracture's full web testing pipeline

Output Files

FileFormatDescription
meta.json JSON Tool identity and engagement metadata
findings.json JSON Universal findings array v1.1
findings.csv CSV CSV mirror of findings
summary.json JSON Aggregated statistics
scan.log TXT Human-readable timestamped log
scan.log.json JSONL Machine-readable JSON log events
errors.log TXT ERROR-level entries only
checkpoint.json JSON Resumable scan checkpoint
api_inventory.json JSON API endpoint inventory
api_map.json JSON API surface map

Invocation Methods

MethodUsage
CLI — Direct cd /opt/pr0t31n/Siphon && python3 siphon.py [OPTIONS]

Run directly with command-line arguments.
Crucible-Managed

Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Depends On

Used By

Third-Party Dependencies & Credits

Tool / LibraryDeveloperTypeLink
Nuclei ProjectDiscovery system https://github.com/projectdiscovery/nuclei
sslscan rbsec system https://github.com/rbsec/sslscan
testssl.sh Dirk Wetter system https://github.com/drwetter/testssl.sh
ffuf joohoi (Joona Hoikkala) system https://github.com/ffuf/ffuf
requests Kenneth Reitz / Python Software Foundation python https://github.com/psf/requests
PyYAML Kirill Simonov (xi) python https://github.com/yaml/pyyaml
grpcurl FullStory system https://github.com/fullstorydev/grpcurl

Metadata

NameSiphon
CategoryExploitation
Version2.34.6
Install Path/opt/pr0t31n/Siphon
Main Filesiphon.py
GitHubhttps://github.com/pr0t31n/Siphon.git