[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFM34KVMSB46VSAJRVM67M":3,"skill-same:01M6AFM34KVMSB46VSAJRVM67M":144},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":78,"repositoryHtmlUrl":79,"repositoryHomepageUrl":80,"ownerHtmlUrl":81,"ownerBlogUrl":82,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6AFM34KVMSB46VSAJRVM67M","performing-api-fuzzing-with-restler",null,"Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles an OpenAPI\u002FSwagger spec into a RESTler grammar, configures authentication, and runs test\u002Ffuzz-lean\u002Ffuzz modes that generate request sequences exercising producer-consumer dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated API security testing.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-fuzzing-with-restler\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"performing api fuzzing with restler","fuzzing","authentication","stateful-testing","automated-testing","restler","openapi","injection","t1059","REST","api-security","testing","generate","pr","auth","microsoft","test","cybersecurity","security","spec","2026-11-10 10:12:30",false,"---\nname: performing-api-fuzzing-with-restler\ndescription: 'Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles\n  an OpenAPI\u002FSwagger spec into a RESTler grammar, configures authentication, and runs\n  test\u002Ffuzz-lean\u002Ffuzz modes that generate request sequences exercising producer-consumer\n  dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection\n  bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated\n  API security testing.\n\n  '\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- fuzzing\n- restler\n- automated-testing\n- openapi\n- stateful-testing\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n- T1055\n- T1059\n---\n# Performing API Fuzzing with RESTler\n\n## When to Use\n\n- Performing automated security testing of REST APIs using their OpenAPI\u002FSwagger specifications\n- Discovering bugs that only manifest through specific sequences of API calls (stateful testing)\n- Finding 500 Internal Server Error responses that indicate unhandled exceptions or crash conditions\n- Testing API input validation by fuzzing parameters with malformed, boundary, and injection payloads\n- Running continuous security regression testing in CI\u002FCD pipelines for API changes\n\n**Do not use** against production environments without explicit authorization and monitoring. RESTler creates and deletes resources aggressively during fuzzing.\n\n## Prerequisites\n\n- Written authorization specifying the target API and acceptable testing scope\n- Python 3.12+ and .NET 8.0 runtime installed\n- RESTler downloaded from https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer\n- OpenAPI\u002FSwagger specification (v2 or v3) for the target API\n- API authentication credentials (tokens, API keys, or OAuth credentials)\n- Isolated test\u002Fstaging environment (RESTler can create thousands of resources per hour)\n\n## Workflow\n\n### Step 1: RESTler Installation and Setup\n\n```bash\n# Clone and build RESTler\ngit clone https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer.git\ncd restler-fuzzer\n\n# Build RESTler\npython3 .\u002Fbuild-restler.py --dest_dir \u002Fopt\u002Frestler\n\n# Verify installation\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler --help\n\n# Alternative: Use pre-built release\n# Download from https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer\u002Freleases\n```\n\n### Step 2: Compile the API Specification\n\n```bash\n# Compile the OpenAPI spec into a RESTler fuzzing grammar\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler compile \\\n    --api_spec \u002Fpath\u002Fto\u002Fopenapi.yaml\n\n# Output directory structure:\n# Compile\u002F\n#   grammar.py          - Generated fuzzing grammar\n#   grammar.json        - Grammar in JSON format\n#   dict.json           - Custom dictionary for fuzzing values\n#   engine_settings.json - Engine configuration\n#   config.json         - Compilation config\n```\n\n**Custom dictionary for targeted fuzzing (dict.json):**\n```json\n{\n    \"restler_fuzzable_string\": [\n        \"fuzzstring\",\n        \"' OR '1'='1\",\n        \"\\\" OR \\\"1\\\"=\\\"1\",\n        \"\u003Cscript>alert(1)\u003C\u002Fscript>\",\n        \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\",\n        \"${7*7}\",\n        \"{{7*7}}\",\n        \"a]UNION SELECT 1,2,3--\",\n        \"\\\"; cat \u002Fetc\u002Fpasswd; echo \\\"\",\n        \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\n    ],\n    \"restler_fuzzable_int\": [\n        \"0\",\n        \"-1\",\n        \"999999999\",\n        \"2147483647\",\n        \"-2147483648\"\n    ],\n    \"restler_fuzzable_bool\": [\"true\", \"false\", \"null\", \"1\", \"0\"],\n    \"restler_fuzzable_datetime\": [\n        \"2024-01-01T00:00:00Z\",\n        \"0000-00-00T00:00:00Z\",\n        \"9999-12-31T23:59:59Z\",\n        \"invalid-date\"\n    ],\n    \"restler_fuzzable_uuid4\": [\n        \"00000000-0000-0000-0000-000000000000\",\n        \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\"\n    ],\n    \"restler_custom_payload\": {\n        \"\u002Fusers\u002F{userId}\": [\"1\", \"0\", \"-1\", \"admin\", \"' OR 1=1--\"],\n        \"\u002Forders\u002F{orderId}\": [\"1\", \"0\", \"999999999\"]\n    }\n}\n```\n\n### Step 3: Configure Authentication\n\n```python\n# authentication_token.py - RESTler authentication module\nimport requests\nimport json\nimport time\n\nclass AuthenticationProvider:\n    def __init__(self):\n        self.token = None\n        self.token_expiry = 0\n        self.auth_url = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\"\n        self.credentials = {\n            \"email\": \"fuzzer@test.com\",\n            \"password\": \"FuzzerPass123!\"\n        }\n\n    def get_token(self):\n        \"\"\"Get or refresh authentication token.\"\"\"\n        current_time = time.time()\n        if self.token and current_time \u003C self.token_expiry - 60:\n            return self.token\n\n        resp = requests.post(self.auth_url, json=self.credentials)\n        if resp.status_code == 200:\n            data = resp.json()\n            self.token = data[\"access_token\"]\n            self.token_expiry = current_time + 3600  # Assume 1-hour TTL\n            return self.token\n        else:\n            raise Exception(f\"Authentication failed: {resp.status_code}\")\n\n    def get_auth_header(self):\n        \"\"\"Return the authentication header for RESTler.\"\"\"\n        token = self.get_token()\n        return f\"Authorization: Bearer {token}\"\n\n# Export the token refresh command for RESTler\nauth = AuthenticationProvider()\nprint(auth.get_auth_header())\n```\n\n**Engine settings for authentication (engine_settings.json):**\n```json\n{\n    \"authentication\": {\n        \"token\": {\n            \"token_refresh_interval\": 300,\n            \"token_refresh_cmd\": \"python3 \u002Fpath\u002Fto\u002Fauthentication_token.py\"\n        }\n    },\n    \"max_combinations\": 20,\n    \"max_request_execution_time\": 30,\n    \"global_producer_timing_delay\": 2,\n    \"no_ssl\": false,\n    \"host\": \"target-api.example.com\",\n    \"target_port\": 443,\n    \"garbage_collection_interval\": 300,\n    \"max_sequence_length\": 10\n}\n```\n\n### Step 4: Run RESTler in Test Mode (Smoke Test)\n\n```bash\n# Test mode: Quick validation that all endpoints are reachable\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler test \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --no_ssl \\\n    --target_ip target-api.example.com \\\n    --target_port 443\n\n# Review test results\ncat Test\u002FResponseBuckets\u002FrunSummary.json\n```\n\n```python\n# Parse test results\nimport json\n\nwith open(\"Test\u002FResponseBuckets\u002FrunSummary.json\") as f:\n    summary = json.load(f)\n\nprint(\"Test Mode Summary:\")\nprint(f\"  Total requests: {summary.get('total_requests_sent', {}).get('num_requests', 0)}\")\nprint(f\"  Successful (2xx): {summary.get('num_fully_valid', 0)}\")\nprint(f\"  Client errors (4xx): {summary.get('num_invalid', 0)}\")\nprint(f\"  Server errors (5xx): {summary.get('num_server_error', 0)}\")\n\n# Identify uncovered endpoints\ncovered = summary.get('covered_endpoints', [])\ntotal = summary.get('total_endpoints', [])\nuncovered = set(total) - set(covered)\nif uncovered:\n    print(f\"\\nUncovered endpoints ({len(uncovered)}):\")\n    for ep in uncovered:\n        print(f\"  - {ep}\")\n```\n\n### Step 5: Run Fuzz-Lean Mode\n\n```bash\n# Fuzz-lean: One pass through all endpoints with security checkers enabled\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler fuzz-lean \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --target_ip target-api.example.com \\\n    --target_port 443 \\\n    --time_budget 1  # 1 hour max\n\n# Checkers automatically enabled in fuzz-lean:\n# - UseAfterFree: Tests accessing resources after deletion\n# - NamespaceRule: Tests accessing resources across namespaces\u002Ftenants\n# - ResourceHierarchy: Tests child resources with wrong parent IDs\n# - LeakageRule: Tests for information disclosure in error responses\n# - InvalidDynamicObject: Tests with malformed dynamic object IDs\n```\n\n### Step 6: Run Full Fuzzing Mode\n\n```bash\n# Full fuzz mode: Extended fuzzing for comprehensive coverage\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler fuzz \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --target_ip target-api.example.com \\\n    --target_port 443 \\\n    --time_budget 4 \\\n    --enable_checkers UseAfterFree NamespaceRule ResourceHierarchy LeakageRule InvalidDynamicObject PayloadBody\n\n# Analyze fuzzing results\npython3 \u003C\u003C'EOF'\nimport json\nimport os\n\nresults_dir = \"Fuzz\u002FResponseBuckets\"\nbugs_dir = \"Fuzz\u002Fbug_buckets\"\n\n# Parse bug buckets\nif os.path.exists(bugs_dir):\n    for bug_file in os.listdir(bugs_dir):\n        if bug_file.endswith(\".txt\"):\n            with open(os.path.join(bugs_dir, bug_file)) as f:\n                content = f.read()\n            print(f\"\\n=== Bug: {bug_file} ===\")\n            print(content[:500])\n\n# Parse response summary\nsummary_file = os.path.join(results_dir, \"runSummary.json\")\nif os.path.exists(summary_file):\n    with open(summary_file) as f:\n        summary = json.load(f)\n    print(f\"\\nFuzz Summary:\")\n    print(f\"  Duration: {summary.get('time_budget_hours', 0)} hours\")\n    print(f\"  Total requests: {summary.get('total_requests_sent', {}).get('num_requests', 0)}\")\n    print(f\"  Bugs found: {summary.get('num_bugs', 0)}\")\n    print(f\"  500 errors: {summary.get('num_server_error', 0)}\")\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Stateful Fuzzing** | API fuzzing that maintains state across requests by using responses from earlier requests as inputs to later ones, enabling testing of multi-step workflows |\n| **Producer-Consumer Dependencies** | RESTler's inference that a value produced by one API call (e.g., a created resource ID) should be consumed by a subsequent call |\n| **Fuzzing Grammar** | Compiled representation of the API specification that defines how to generate valid and invalid requests for each endpoint |\n| **Checker** | RESTler security rule that tests for specific vulnerability patterns like use-after-free, namespace isolation, or information leakage |\n| **Bug Bucket** | RESTler's categorization of discovered bugs by type and endpoint, grouping similar failures for efficient triage |\n| **Garbage Collection** | RESTler's periodic cleanup of resources created during fuzzing to prevent resource exhaustion on the target system |\n\n## Tools & Systems\n\n- **RESTler**: Microsoft Research's stateful REST API fuzzing tool that compiles OpenAPI specs into fuzzing grammars\n- **Schemathesis**: Property-based API testing tool that generates test cases from OpenAPI\u002FGraphQL schemas\n- **Dredd**: API testing tool that validates API implementations against OpenAPI\u002FAPI Blueprint documentation\n- **Fuzz-lightyear**: Yelp's stateless API fuzzer focused on finding authentication and authorization vulnerabilities\n- **API Fuzzer**: OWASP tool for API endpoint fuzzing with customizable payload dictionaries\n\n## Common Scenarios\n\n### Scenario: Microservice API Fuzzing Campaign\n\n**Context**: A fintech company has 12 microservice APIs with OpenAPI specifications. Before a major release, the security team runs RESTler fuzzing against each service in the staging environment to catch bugs.\n\n**Approach**:\n1. Collect OpenAPI specs for all 12 services and compile each into a RESTler grammar\n2. Configure authentication for each service with service-specific credentials\n3. Run test mode on each service to validate endpoint reachability and fix grammar issues\n4. Run fuzz-lean mode (1 hour per service) to identify quick wins\n5. Find 23 bugs in fuzz-lean mode: 8 unhandled 500 errors, 5 use-after-free patterns, 4 namespace isolation failures, 6 information leakage in error responses\n6. Run full fuzz mode (4 hours per service) on the 5 services with the most bugs\n7. Discover 47 additional bugs including a critical authentication bypass where deleting a user and reusing their token still allows access\n8. Generate bug reports and track remediation through JIRA integration\n\n**Pitfalls**:\n- Running RESTler against production without understanding that it creates and deletes thousands of resources\n- Not configuring authentication correctly, causing RESTler to only test unauthenticated access\n- Using the default dictionary without adding application-specific injection payloads\n- Not setting a time budget, allowing RESTler to run indefinitely\n- Ignoring the compilation warnings that indicate endpoints RESTler cannot reach due to dependency issues\n\n## Output Format\n\n```\n## RESTler API Fuzzing Report\n\n**Target**: User Service API (staging.example.com)\n**Specification**: OpenAPI 3.0 (42 endpoints)\n**Duration**: 4 hours (full fuzz mode)\n**Total Requests**: 145,832\n\n### Bug Summary\n\n| Category | Count | Severity |\n|----------|-------|----------|\n| 500 Internal Server Error | 12 | High |\n| Use After Free | 3 | Critical |\n| Namespace Rule Violation | 5 | Critical |\n| Information Leakage | 8 | Medium |\n| Resource Leak | 4 | Low |\n\n### Critical Findings\n\n**1. Use-After-Free: Deleted user token still valid**\n- Sequence: POST \u002Fusers -> DELETE \u002Fusers\u002F{id} -> GET \u002Fusers\u002F{id}\n- After deleting user, GET with the deleted user's token returns 200\n- Impact: Deleted accounts can still access the API\n\n**2. Namespace Violation: Cross-tenant data access**\n- Sequence: POST \u002Fusers (tenant A) -> GET \u002Fusers\u002F{id} (tenant B token)\n- User created by tenant A is accessible with tenant B's credentials\n- Impact: Multi-tenant isolation breach\n\n**3. 500 Error: Unhandled integer overflow**\n- Request: POST \u002Forders {\"quantity\": 2147483648}\n- Response: 500 Internal Server Error with stack trace\n- Impact: DoS potential, information disclosure via stack trace\n\n### Coverage\n\n- Endpoints covered: 38\u002F42 (90.5%)\n- Uncovered: POST \u002Fadmin\u002Fmigrate, DELETE \u002Fadmin\u002Fcache,\n  PUT \u002Fconfig\u002Fadvanced, POST \u002Fwebhooks\u002Ftest\n```\n","# Performing API Fuzzing with RESTler\n\n## When to Use\n\n- Performing automated security testing of REST APIs using their OpenAPI\u002FSwagger specifications\n- Discovering bugs that only manifest through specific sequences of API calls (stateful testing)\n- Finding 500 Internal Server Error responses that indicate unhandled exceptions or crash conditions\n- Testing API input validation by fuzzing parameters with malformed, boundary, and injection payloads\n- Running continuous security regression testing in CI\u002FCD pipelines for API changes\n\n**Do not use** against production environments without explicit authorization and monitoring. RESTler creates and deletes resources aggressively during fuzzing.\n\n## Prerequisites\n\n- Written authorization specifying the target API and acceptable testing scope\n- Python 3.12+ and .NET 8.0 runtime installed\n- RESTler downloaded from https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer\n- OpenAPI\u002FSwagger specification (v2 or v3) for the target API\n- API authentication credentials (tokens, API keys, or OAuth credentials)\n- Isolated test\u002Fstaging environment (RESTler can create thousands of resources per hour)\n\n## Workflow\n\n### Step 1: RESTler Installation and Setup\n\n```bash\n# Clone and build RESTler\ngit clone https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer.git\ncd restler-fuzzer\n\n# Build RESTler\npython3 .\u002Fbuild-restler.py --dest_dir \u002Fopt\u002Frestler\n\n# Verify installation\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler --help\n\n# Alternative: Use pre-built release\n# Download from https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frestler-fuzzer\u002Freleases\n```\n\n### Step 2: Compile the API Specification\n\n```bash\n# Compile the OpenAPI spec into a RESTler fuzzing grammar\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler compile \\\n    --api_spec \u002Fpath\u002Fto\u002Fopenapi.yaml\n\n# Output directory structure:\n# Compile\u002F\n#   grammar.py          - Generated fuzzing grammar\n#   grammar.json        - Grammar in JSON format\n#   dict.json           - Custom dictionary for fuzzing values\n#   engine_settings.json - Engine configuration\n#   config.json         - Compilation config\n```\n\n**Custom dictionary for targeted fuzzing (dict.json):**\n```json\n{\n    \"restler_fuzzable_string\": [\n        \"fuzzstring\",\n        \"' OR '1'='1\",\n        \"\\\" OR \\\"1\\\"=\\\"1\",\n        \"\u003Cscript>alert(1)\u003C\u002Fscript>\",\n        \"..\u002F..\u002F..\u002Fetc\u002Fpasswd\",\n        \"${7*7}\",\n        \"{{7*7}}\",\n        \"a]UNION SELECT 1,2,3--\",\n        \"\\\"; cat \u002Fetc\u002Fpasswd; echo \\\"\",\n        \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\n    ],\n    \"restler_fuzzable_int\": [\n        \"0\",\n        \"-1\",\n        \"999999999\",\n        \"2147483647\",\n        \"-2147483648\"\n    ],\n    \"restler_fuzzable_bool\": [\"true\", \"false\", \"null\", \"1\", \"0\"],\n    \"restler_fuzzable_datetime\": [\n        \"2024-01-01T00:00:00Z\",\n        \"0000-00-00T00:00:00Z\",\n        \"9999-12-31T23:59:59Z\",\n        \"invalid-date\"\n    ],\n    \"restler_fuzzable_uuid4\": [\n        \"00000000-0000-0000-0000-000000000000\",\n        \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\"\n    ],\n    \"restler_custom_payload\": {\n        \"\u002Fusers\u002F{userId}\": [\"1\", \"0\", \"-1\", \"admin\", \"' OR 1=1--\"],\n        \"\u002Forders\u002F{orderId}\": [\"1\", \"0\", \"999999999\"]\n    }\n}\n```\n\n### Step 3: Configure Authentication\n\n```python\n# authentication_token.py - RESTler authentication module\nimport requests\nimport json\nimport time\n\nclass AuthenticationProvider:\n    def __init__(self):\n        self.token = None\n        self.token_expiry = 0\n        self.auth_url = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\u002Fauth\u002Flogin\"\n        self.credentials = {\n            \"email\": \"fuzzer@test.com\",\n            \"password\": \"FuzzerPass123!\"\n        }\n\n    def get_token(self):\n        \"\"\"Get or refresh authentication token.\"\"\"\n        current_time = time.time()\n        if self.token and current_time \u003C self.token_expiry - 60:\n            return self.token\n\n        resp = requests.post(self.auth_url, json=self.credentials)\n        if resp.status_code == 200:\n            data = resp.json()\n            self.token = data[\"access_token\"]\n            self.token_expiry = current_time + 3600  # Assume 1-hour TTL\n            return self.token\n        else:\n            raise Exception(f\"Authentication failed: {resp.status_code}\")\n\n    def get_auth_header(self):\n        \"\"\"Return the authentication header for RESTler.\"\"\"\n        token = self.get_token()\n        return f\"Authorization: Bearer {token}\"\n\n# Export the token refresh command for RESTler\nauth = AuthenticationProvider()\nprint(auth.get_auth_header())\n```\n\n**Engine settings for authentication (engine_settings.json):**\n```json\n{\n    \"authentication\": {\n        \"token\": {\n            \"token_refresh_interval\": 300,\n            \"token_refresh_cmd\": \"python3 \u002Fpath\u002Fto\u002Fauthentication_token.py\"\n        }\n    },\n    \"max_combinations\": 20,\n    \"max_request_execution_time\": 30,\n    \"global_producer_timing_delay\": 2,\n    \"no_ssl\": false,\n    \"host\": \"target-api.example.com\",\n    \"target_port\": 443,\n    \"garbage_collection_interval\": 300,\n    \"max_sequence_length\": 10\n}\n```\n\n### Step 4: Run RESTler in Test Mode (Smoke Test)\n\n```bash\n# Test mode: Quick validation that all endpoints are reachable\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler test \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --no_ssl \\\n    --target_ip target-api.example.com \\\n    --target_port 443\n\n# Review test results\ncat Test\u002FResponseBuckets\u002FrunSummary.json\n```\n\n```python\n# Parse test results\nimport json\n\nwith open(\"Test\u002FResponseBuckets\u002FrunSummary.json\") as f:\n    summary = json.load(f)\n\nprint(\"Test Mode Summary:\")\nprint(f\"  Total requests: {summary.get('total_requests_sent', {}).get('num_requests', 0)}\")\nprint(f\"  Successful (2xx): {summary.get('num_fully_valid', 0)}\")\nprint(f\"  Client errors (4xx): {summary.get('num_invalid', 0)}\")\nprint(f\"  Server errors (5xx): {summary.get('num_server_error', 0)}\")\n\n# Identify uncovered endpoints\ncovered = summary.get('covered_endpoints', [])\ntotal = summary.get('total_endpoints', [])\nuncovered = set(total) - set(covered)\nif uncovered:\n    print(f\"\\nUncovered endpoints ({len(uncovered)}):\")\n    for ep in uncovered:\n        print(f\"  - {ep}\")\n```\n\n### Step 5: Run Fuzz-Lean Mode\n\n```bash\n# Fuzz-lean: One pass through all endpoints with security checkers enabled\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler fuzz-lean \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --target_ip target-api.example.com \\\n    --target_port 443 \\\n    --time_budget 1  # 1 hour max\n\n# Checkers automatically enabled in fuzz-lean:\n# - UseAfterFree: Tests accessing resources after deletion\n# - NamespaceRule: Tests accessing resources across namespaces\u002Ftenants\n# - ResourceHierarchy: Tests child resources with wrong parent IDs\n# - LeakageRule: Tests for information disclosure in error responses\n# - InvalidDynamicObject: Tests with malformed dynamic object IDs\n```\n\n### Step 6: Run Full Fuzzing Mode\n\n```bash\n# Full fuzz mode: Extended fuzzing for comprehensive coverage\n\u002Fopt\u002Frestler\u002Frestler\u002FRestler fuzz \\\n    --grammar_file Compile\u002Fgrammar.py \\\n    --dictionary_file Compile\u002Fdict.json \\\n    --settings Compile\u002Fengine_settings.json \\\n    --target_ip target-api.example.com \\\n    --target_port 443 \\\n    --time_budget 4 \\\n    --enable_checkers UseAfterFree NamespaceRule ResourceHierarchy LeakageRule InvalidDynamicObject PayloadBody\n\n# Analyze fuzzing results\npython3 \u003C\u003C'EOF'\nimport json\nimport os\n\nresults_dir = \"Fuzz\u002FResponseBuckets\"\nbugs_dir = \"Fuzz\u002Fbug_buckets\"\n\n# Parse bug buckets\nif os.path.exists(bugs_dir):\n    for bug_file in os.listdir(bugs_dir):\n        if bug_file.endswith(\".txt\"):\n            with open(os.path.join(bugs_dir, bug_file)) as f:\n                content = f.read()\n            print(f\"\\n=== Bug: {bug_file} ===\")\n            print(content[:500])\n\n# Parse response summary\nsummary_file = os.path.join(results_dir, \"runSummary.json\")\nif os.path.exists(summary_file):\n    with open(summary_file) as f:\n        summary = json.load(f)\n    print(f\"\\nFuzz Summary:\")\n    print(f\"  Duration: {summary.get('time_budget_hours', 0)} hours\")\n    print(f\"  Total requests: {summary.get('total_requests_sent', {}).get('num_requests', 0)}\")\n    print(f\"  Bugs found: {summary.get('num_bugs', 0)}\")\n    print(f\"  500 errors: {summary.get('num_server_error', 0)}\")\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Stateful Fuzzing** | API fuzzing that maintains state across requests by using responses from earlier requests as inputs to later ones, enabling testing of multi-step workflows |\n| **Producer-Consumer Dependencies** | RESTler's inference that a value produced by one API call (e.g., a created resource ID) should be consumed by a subsequent call |\n| **Fuzzing Grammar** | Compiled representation of the API specification that defines how to generate valid and invalid requests for each endpoint |\n| **Checker** | RESTler security rule that tests for specific vulnerability patterns like use-after-free, namespace isolation, or information leakage |\n| **Bug Bucket** | RESTler's categorization of discovered bugs by type and endpoint, grouping similar failures for efficient triage |\n| **Garbage Collection** | RESTler's periodic cleanup of resources created during fuzzing to prevent resource exhaustion on the target system |\n\n## Tools & Systems\n\n- **RESTler**: Microsoft Research's stateful REST API fuzzing tool that compiles OpenAPI specs into fuzzing grammars\n- **Schemathesis**: Property-based API testing tool that generates test cases from OpenAPI\u002FGraphQL schemas\n- **Dredd**: API testing tool that validates API implementations against OpenAPI\u002FAPI Blueprint documentation\n- **Fuzz-lightyear**: Yelp's stateless API fuzzer focused on finding authentication and authorization vulnerabilities\n- **API Fuzzer**: OWASP tool for API endpoint fuzzing with customizable payload dictionaries\n\n## Common Scenarios\n\n### Scenario: Microservice API Fuzzing Campaign\n\n**Context**: A fintech company has 12 microservice APIs with OpenAPI specifications. Before a major release, the security team runs RESTler fuzzing against each service in the staging environment to catch bugs.\n\n**Approach**:\n1. Collect OpenAPI specs for all 12 services and compile each into a RESTler grammar\n2. Configure authentication for each service with service-specific credentials\n3. Run test mode on each service to validate endpoint reachability and fix grammar issues\n4. Run fuzz-lean mode (1 hour per service) to identify quick wins\n5. Find 23 bugs in fuzz-lean mode: 8 unhandled 500 errors, 5 use-after-free patterns, 4 namespace isolation failures, 6 information leakage in error responses\n6. Run full fuzz mode (4 hours per service) on the 5 services with the most bugs\n7. Discover 47 additional bugs including a critical authentication bypass where deleting a user and reusing their token still allows access\n8. Generate bug reports and track remediation through JIRA integration\n\n**Pitfalls**:\n- Running RESTler against production without understanding that it creates and deletes thousands of resources\n- Not configuring authentication correctly, causing RESTler to only test unauthenticated access\n- Using the default dictionary without adding application-specific injection payloads\n- Not setting a time budget, allowing RESTler to run indefinitely\n- Ignoring the compilation warnings that indicate endpoints RESTler cannot reach due to dependency issues\n\n## Output Format\n\n```\n## RESTler API Fuzzing Report\n\n**Target**: User Service API (staging.example.com)\n**Specification**: OpenAPI 3.0 (42 endpoints)\n**Duration**: 4 hours (full fuzz mode)\n**Total Requests**: 145,832\n\n### Bug Summary\n\n| Category | Count | Severity |\n|----------|-------|----------|\n| 500 Internal Server Error | 12 | High |\n| Use After Free | 3 | Critical |\n| Namespace Rule Violation | 5 | Critical |\n| Information Leakage | 8 | Medium |\n| Resource Leak | 4 | Low |\n\n### Critical Findings\n\n**1. Use-After-Free: Deleted user token still valid**\n- Sequence: POST \u002Fusers -> DELETE \u002Fusers\u002F{id} -> GET \u002Fusers\u002F{id}\n- After deleting user, GET with the deleted user's token returns 200\n- Impact: Deleted accounts can still access the API\n\n**2. Namespace Violation: Cross-tenant data access**\n- Sequence: POST \u002Fusers (tenant A) -> GET \u002Fusers\u002F{id} (tenant B token)\n- User created by tenant A is accessible with tenant B's credentials\n- Impact: Multi-tenant isolation breach\n\n**3. 500 Error: Unhandled integer overflow**\n- Request: POST \u002Forders {\"quantity\": 2147483648}\n- Response: 500 Internal Server Error with stack trace\n- Impact: DoS potential, information disclosure via stack trace\n\n### Coverage\n\n- Endpoints covered: 38\u002F42 (90.5%)\n- Uncovered: POST \u002Fadmin\u002Fmigrate, DELETE \u002Fadmin\u002Fcache,\n  PUT \u002Fconfig\u002Fadvanced, POST \u002Fwebhooks\u002Ftest\n```\n",{"name":5,"tags":60,"author":61,"domain":52,"license":15,"version":62,"nist_csf":63,"subdomain":45,"description":68,"mitre_attack":69},[45,36,40,39,41,38],"mahipal","1.0.0",[64,65,66,67],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles an OpenAPI\u002FSwagger spec into a RESTler grammar, configures authentication, and runs test\u002Ffuzz-lean\u002Ffuzz modes that generate request sequences exercising producer-consumer dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated API security testing.\n",[70,71,72,73,74],"T1190","T1059.007","T1552.001","T1055","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-api-fuzzing-with-restler",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-fuzzing-with-restler",{"tool":91,"command":92},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-fuzzing-with-restler",{"tool":94,"command":95},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-api-fuzzing-with-restler","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-fuzzing-with-restler\u002FSKILL.md",true,[99,104,110,114,118,122,126,130,134,138],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-fuzzing-with-restler\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002FADR-template.md","REFERENCE","参考文档",1644,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002FADR-template.md",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md",1965,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-fuzzing-with-restler\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fcode-examples.md",15163,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002Fcode-examples.md",{"path":119,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fdecision-types.md",4431,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002Fdecision-types.md",{"path":123,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002FDELTAS-template.md",3113,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002FDELTAS-template.md",{"path":127,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002FDES-template.md",1359,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002FDES-template.md",{"path":131,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Ftechnical-diagrams.md",11953,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002Ftechnical-diagrams.md",{"path":135,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002FVISION-template.md",2114,"https:\u002F\u002Fgithub.com\u002Fasermax\u002Fclaude-plugins\u002Fblob\u002Fmaster\u002Fkatachi\u002Fskills\u002Fframework-core\u002Freferences\u002FVISION-template.md",{"path":139,"resourceType":140,"resourceTypeDesc":141,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Fagent.py","SCRIPT","脚本",7425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-api-fuzzing-with-restler\u002Fscripts\u002Fagent.py",[145,170,194,219,245,272],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[151],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,53,52,157,158,48,159,160,161,162,163,164,165,166,167,168,169],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[176],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[178,166,179,180,53,181,52,48,182,183,184,185,186,187,188,189,190,191,192,193],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":202,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[200,201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[188,203,204,205,46,52,206,207,182,208,209,210,211,212,213,214,215,216,217,218],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[225],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,52,230,231,232,233,234,235,236,237,238,239,240,241,185,242,243,244],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":252,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[251],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[253,254,255,52,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":273,"name":274,"nameZh":6,"description":275,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":276,"categories":277,"keywords":279,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[278],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[53,280,52,281,282,283,284,285,286,287,288,214,289,215,290,291,292,293,294,295],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]