Update REST Assessment Cheat Sheet: OpenAPI, JWT/OAuth2, BOLA, Mass Assignment, Rate Limiting

[franrob-projects]

What this PR addresses

Closes #2023

The REST Assessment Cheat Sheet is a solid foundation but references WSDL/WADL as service description formats without addressing OpenAPI — the standard that now describes virtually every modern REST API. It also has no coverage of the authentication mechanisms, authorization flaws, or abuse vectors most commonly found in APIs today.

Changes

Five new sections added between the existing fuzzing guidance and the Related Resources footer:

1. Assessing OpenAPI/Swagger-based REST APIs

• Common schema discovery paths (/openapi.json, /swagger.json, /docs, etc.)
• Using the schema for complete endpoint enumeration, including paths not exposed in the UI
• Undocumented field discovery
• Schema-driven fuzzing with ZAP and Schemathesis

2. JWT and OAuth2 Assessment

• alg: none and algorithm confusion attacks
• Claim tampering and expiry bypass
• kid header injection (SQL injection, path traversal, SSRF)
• OAuth2: scope enforcement, cross-tenant token reuse, PKCE requirement, refresh token rotation

3. Broken Object Level Authorization (BOLA)

• Horizontal and vertical privilege escalation patterns
• Testing all HTTP methods independently
• Indirect/encoded reference enumeration

4. Mass Assignment in JSON APIs

• Identifying bindable fields from schema/response comparison
• Injecting extra fields in POST, PUT, and PATCH requests
• Numeric privilege escalation targets (balance, credits, role)

5. Rate Limiting and Throttling Assessment

• Baseline measurement and standard rate-limit headers
• Confirming 429 enforcement
• Bypass techniques (IP header rotation, method switching)
• Sensitive operation coverage (OTP, password reset, enumeration)

Updated Related Resources section to include the OWASP API Security Top 10, JWT Cheat Sheet, OAuth2 Cheat Sheet, and Schemathesis.

Checklist

• All markdown files do not raise any validation policy violation
• All markdown files follow the format rules
• Any references to websites have been formatted as [TEXT](URL)
• The contribution has been verified for accuracy against current attack/defence literature

AI Tool Usage Disclosure

• I have not used AI tools to generate the contents of this PR