[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7CWQCX9WDFFC50F5S328X":3,"skill-same:01M6F7CWQCX9WDFFC50F5S328X":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":41,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":71,"install":72,"resources":85},"01M6F7CWQCX9WDFFC50F5S328X","hunt-api-misconfig",null,"Hunt API security misconfiguration","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-api-misconfig\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"hunt api misconfig","api","hunt","2026","testing","for","relevant","helper","offensive","scripts","scope","commands","api security","main","community","only","public","misconfiguration","Tools","owasp","https","license","testing tools","research","security","github","2026-11-10 10:12:30",false,"---\nname: hunt-api-misconfig\ndescription: Hunt API security misconfiguration\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: hackerone_public, owasp_api_top10_2023, public_research\nreport_count: 0\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## 12. API SECURITY MISCONFIGURATION\n\n### Mass Assignment\n```javascript\nUser.update(req.body)  \u002F\u002F body has {\"role\": \"admin\"} → privilege escalation\n```\n\n### JWT None Algorithm\n```python\nheader = {\"alg\": \"none\", \"typ\": \"JWT\"}\npayload = {\"sub\": 1, \"role\": \"admin\"}\n# Pseudocode only: JSON-serialize and base64url-encode without padding.\n# A token with alg=none is a candidate; correct verifiers reject it.\n```\n\n### JWT RS256 → HS256 Algorithm Confusion\n```python\n# Get server's public key from \u002F.well-known\u002Fjwks.json\n# Sign token with public key as HMAC secret\ntoken = jwt.encode({\"sub\": \"admin\", \"role\": \"admin\"}, pub_key, algorithm=\"HS256\")\n# Only a misconfigured verifier with compatible key handling could accept it;\n# modern libraries commonly reject asymmetric keys as HMAC secrets.\n```\n\n### Prototype Pollution\n```javascript\n\u002F\u002F Server-side — Node.js merge without protection\n{\"__proto__\": {\"admin\": true}}\n{\"constructor\": {\"prototype\": {\"admin\": true}}}\n\u002F\u002F URL: ?__proto__[isAdmin]=true&__proto__[role]=superadmin\n```\n\nFor server-side prototype pollution, hunt for an object merge primitive first, then a sink. Favor\nJSON\u002Fobject update endpoints such as profile, address, preferences, settings, cart, admin job, import,\nor webhook configuration. Do not stop at a 200 response to `__proto__`; prove that polluted prototype\nstate reaches a later operation.\n\nHunt sequence:\n\n1. **Find an object-update endpoint.** Prefer endpoints that accept many named fields or JSON objects.\n   Try both JSON and form encodings when the app accepts forms. Include CSRF\u002Fsession fields when needed.\n2. **Pollute harmless marker properties.** Send variants such as:\n\n```\n{\"__proto__\":{\"polluted\":\"pp-1337\"}}\n{\"constructor\":{\"prototype\":{\"polluted\":\"pp-1337\"}}}\n__proto__[polluted]=pp-1337\nconstructor[prototype][polluted]=pp-1337\n```\n\n3. **Trigger a separate sink.** After pollution, request account\u002Fprofile\u002Fadmin\u002Fjob\u002Fexport\u002Fsearch\u002Frender\n   endpoints and compare with baseline. Strong signals include changed JSON defaults, unexpected fields,\n   server errors mentioning object properties, changed job output, template\u002Frender errors, or command\u002Fjob\n   behavior changes.\n4. **Escalate only through learned sinks.** Candidate properties depend on the sink:\n\nUse only the inert `polluted` marker in a disposable test process; command\u002Fjob,\nrole-changing or inspector properties are escalation hypotheses, not default probes.\n\n5. **Stop at an inert controlled marker.** Prototype state may be process-global and affect other users. Use a disposable isolated process with approved restart\u002Fcleanup; never read secrets or trigger shell\u002Finspector gadgets on a shared production process.\n\n### Server-Side Parameter Pollution in Backend URL \u002F REST URL Construction\n\nUse this when a frontend form or endpoint appears to call a server-side API on your behalf\n(password reset, account lookup, profile fetch, product lookup, stock check, search). The bug is not\nordinary client-side query pollution. The server takes your input and interpolates it into a backend\nURL path or query string, such as:\n\n```\n\u002Fapi\u002Finternal\u002Fusers\u002F\u003Cusername>\u002Ffield\u002Femail\n\u002Fapi\u002Fusers\u002F\u003Cid>\n\u002Fapi\u002Fusers?username=\u003Cusername>&field=email\n```\n\nHunt sequence:\n\n1. **Find the flow and read the client request.** Fetch the page and any referenced JavaScript. Look\n   for form actions, `fetch(...)`, hidden CSRF fields, and the exact parameter name the browser sends.\n   If there is a reset\u002Faccount form, test known usernames first to learn the normal success\u002Ferror shape.\n2. **Determine whether input lands in a backend path or query.** Send URL metacharacters in the input:\n   `#`, `?`, `&x=y`, `\u002F`, `..\u002F`, and encoded forms `%23`, `%3f`, `%26x=y`, `%2f`, `%2e%2e%2f`.\n   Distinct errors such as `Invalid route`, `API definition`, `unsupported field`, or changed returned\n   fields are routing hypotheses, not proof of server-side interpolation; compare controlled fixtures and inspect server behavior.\n3. **Use path traversal to move inside the server-side URL.** If `username\u002F..\u002Fother-user` changes the\n   referenced account, the input is in a REST path segment. Then try appending route fragments such as\n   `\u002Ffield\u002Femail`, `\u002Ffield\u002Fid`, `\u002Ffield\u002Fusername`, `\u002Ffield\u002FsyntheticCanary`, and terminate the rest\n   of the original backend path with `#` or `%23` when the backend URL parser honors fragments.\n4. **Discover API documentation from errors.** When an error says to consult the API definition, probe\n   common documentation\u002Fspec paths: `\u002Fopenapi.json`, `\u002Fswagger.json`, `\u002Fapi-docs`, `\u002Fapi\u002Fswagger.json`,\n   `\u002Fswagger\u002Fv1\u002Fswagger.json`, `\u002Fv3\u002Fapi-docs`, and path-traversal variants that attempt to reach the\n   spec from the vulnerable backend route. A spec or descriptive route error tells you valid resources\n   and field names.\n5. **Validate a controlled boundary.** Use two owner-controlled synthetic accounts and a harmless protected canary field. Do not retrieve another user’s reset token, complete takeover or send reset messages. An error difference alone is not evidence of data access.\n\nPayload patterns to try, adapted to the observed parameter name:\n\n```\nusername=administrator%23\nusername=administrator%3f\nusername=administrator%2f..%2fvictimuser\nusername=administrator\u002F..\u002Fvictimuser\nusername=administrator\u002Ffield\u002Femail%23\nusername=administrator\u002Ffield\u002Fid%23\nusername=administrator\u002Ffield\u002FsyntheticCanary%23\nusername=administrator%2ffield%2fpasswordResetToken%23\n```\n\n### CORS Exploitation\n```bash\n# Test: reflected origin + credentials\ncurl -s -I -H \"Origin: https:\u002F\u002Fcontrolled-origin.example\" https:\u002F\u002Ftarget.example\u002Fapi\u002Fuser\u002Fme\n# If: Access-Control-Allow-Origin: https:\u002F\u002Fcontrolled-origin.example + Access-Control-Allow-Credentials: true\n# → Candidate only: browser credentials, SameSite, preflight and readable sensitive body must be demonstrated with controlled identities\n```\n\n---\n\n## OData authorization and parser-boundary review\n\nOData query options can expose information or consume resources only when the actual\nservice’s authorization, parser or query-cost controls are inadequate. Do not assume\noperator casing\u002Fencoding equivalence, a WAF bypass, SQL injection, XXE or a current\nCVE from the presence of OData. Dialect\u002Fversion\u002Fprovider behavior differs.\n\nUse a tiny owner-approved sandbox with synthetic data:\n\n1. Establish the exact service\u002Fversion and an authenticated low-privilege identity.\n2. Create owned records A\u002FB with a protected synthetic `canary` field, documented\n   expected permissions and a reset path. Inspect the service schema as inert data.\n3. Compare `$select`, `$filter`, `$orderby` and `$expand` against expected field AND\n   related-object authorization. Do not use real password hashes, cards or PII.\n4. For example, if A cannot read `canary`, ordering\u002Ffiltering by it must not reveal\n   its value through a repeatable oracle. Document the controlled difference and\n   rule, not merely a response count.\n5. Test at most an approved small batch\u002Fnesting depth; bound work per inner operation\n   and preserve auth per subrequest. A parsing difference alone is not exploitation.\n\nNo destructive SQL, blind extraction loop or unlimited expansion is needed for a\nminimal report. Review the provider’s current security advisories and original\nresearch before claiming any historical version range, patch date or public case.\n\n## OpenAPI \u002F Swagger exposure\n\nPublic documentation may be intentional; it is not itself an authentication bypass,\ncomplete inventory or proof that every described operation is deployed. Fetch only\napproved bounded spec URLs, validate schema and treat operation descriptions,\nexternal `$ref` targets, servers and example URLs as untrusted data. Never automatically\nfeed every path to a scanner, execute “Try it out”, or follow third-party references.\n\nA useful static check is `jq '.paths | keys' approved-spec.json` on a private local\ncopy. Then compare a single owned synthetic object across authorized\u002Funauthorized\nidentities. Privileged writable DTO fields are candidates requiring persisted-state\nverification, not proof from a schema name or 200 status. Remote Swagger UI config\nloading\u002Fversion banners require current bundle configuration and advisory checks;\ndo not send crafted links to unsuspecting users. No public case, payout, CVE range\nor target behavior has been verified by these examples.\n\n## Related Skills & Chains\n\n- **`hunt-ato`** — Mass assignment on signup\u002Fprofile is the fastest path to admin. Chain primitive: API mass assignment + `hunt-ato` → `role=admin` set on signup → ATO via privileged role on first login.\n- **`hunt-auth-bypass`** — JWT flaws collapse the entire auth layer. Chain primitive: JWT `alg=none` + `hunt-auth-bypass` → impersonate any user by setting `sub` to victim ID, no signature required.\n- **`hunt-rce`** — Prototype pollution gadgets in Node.js dependencies (lodash, mongoose, jQuery) reach `child_process.spawn`. Chain primitive: Prototype pollution (`__proto__.shell=true`) + `hunt-rce` (Node.js gadget chain) → RCE on the API node.\n- **`hunt-subdomain`** — CORS regex with wildcard subdomain trusts a takeoverable host. Chain primitive: CORS allowlist `*.target.com` + subdomain takeover → attacker-controlled origin reads credentialed API responses.\n- **`security-arsenal`** — Load the JWT Attack Payloads section (alg=none, kid path traversal, JWK injection, embedded JWK) and the Mass-Assignment Field Wordlist (`is_admin`, `role`, `verified`, `permissions`, `org_id`, `tenant_id`).\n- **`triage-validation`** — Apply the Server-Policy-vs-State gate: a permissive CORS header alone is informational; demonstrate actual cross-origin credentialed read of sensitive data before reporting.\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; separately review official tool provenance and current compatibility before installation.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## 12. API SECURITY MISCONFIGURATION\n\n### Mass Assignment\n```javascript\nUser.update(req.body)  \u002F\u002F body has {\"role\": \"admin\"} → privilege escalation\n```\n\n### JWT None Algorithm\n```python\nheader = {\"alg\": \"none\", \"typ\": \"JWT\"}\npayload = {\"sub\": 1, \"role\": \"admin\"}\n# Pseudocode only: JSON-serialize and base64url-encode without padding.\n# A token with alg=none is a candidate; correct verifiers reject it.\n```\n\n### JWT RS256 → HS256 Algorithm Confusion\n```python\n# Get server's public key from \u002F.well-known\u002Fjwks.json\n# Sign token with public key as HMAC secret\ntoken = jwt.encode({\"sub\": \"admin\", \"role\": \"admin\"}, pub_key, algorithm=\"HS256\")\n# Only a misconfigured verifier with compatible key handling could accept it;\n# modern libraries commonly reject asymmetric keys as HMAC secrets.\n```\n\n### Prototype Pollution\n```javascript\n\u002F\u002F Server-side — Node.js merge without protection\n{\"__proto__\": {\"admin\": true}}\n{\"constructor\": {\"prototype\": {\"admin\": true}}}\n\u002F\u002F URL: ?__proto__[isAdmin]=true&__proto__[role]=superadmin\n```\n\nFor server-side prototype pollution, hunt for an object merge primitive first, then a sink. Favor\nJSON\u002Fobject update endpoints such as profile, address, preferences, settings, cart, admin job, import,\nor webhook configuration. Do not stop at a 200 response to `__proto__`; prove that polluted prototype\nstate reaches a later operation.\n\nHunt sequence:\n\n1. **Find an object-update endpoint.** Prefer endpoints that accept many named fields or JSON objects.\n   Try both JSON and form encodings when the app accepts forms. Include CSRF\u002Fsession fields when needed.\n2. **Pollute harmless marker properties.** Send variants such as:\n\n```\n{\"__proto__\":{\"polluted\":\"pp-1337\"}}\n{\"constructor\":{\"prototype\":{\"polluted\":\"pp-1337\"}}}\n__proto__[polluted]=pp-1337\nconstructor[prototype][polluted]=pp-1337\n```\n\n3. **Trigger a separate sink.** After pollution, request account\u002Fprofile\u002Fadmin\u002Fjob\u002Fexport\u002Fsearch\u002Frender\n   endpoints and compare with baseline. Strong signals include changed JSON defaults, unexpected fields,\n   server errors mentioning object properties, changed job output, template\u002Frender errors, or command\u002Fjob\n   behavior changes.\n4. **Escalate only through learned sinks.** Candidate properties depend on the sink:\n\nUse only the inert `polluted` marker in a disposable test process; command\u002Fjob,\nrole-changing or inspector properties are escalation hypotheses, not default probes.\n\n5. **Stop at an inert controlled marker.** Prototype state may be process-global and affect other users. Use a disposable isolated process with approved restart\u002Fcleanup; never read secrets or trigger shell\u002Finspector gadgets on a shared production process.\n\n### Server-Side Parameter Pollution in Backend URL \u002F REST URL Construction\n\nUse this when a frontend form or endpoint appears to call a server-side API on your behalf\n(password reset, account lookup, profile fetch, product lookup, stock check, search). The bug is not\nordinary client-side query pollution. The server takes your input and interpolates it into a backend\nURL path or query string, such as:\n\n```\n\u002Fapi\u002Finternal\u002Fusers\u002F\u003Cusername>\u002Ffield\u002Femail\n\u002Fapi\u002Fusers\u002F\u003Cid>\n\u002Fapi\u002Fusers?username=\u003Cusername>&field=email\n```\n\nHunt sequence:\n\n1. **Find the flow and read the client request.** Fetch the page and any referenced JavaScript. Look\n   for form actions, `fetch(...)`, hidden CSRF fields, and the exact parameter name the browser sends.\n   If there is a reset\u002Faccount form, test known usernames first to learn the normal success\u002Ferror shape.\n2. **Determine whether input lands in a backend path or query.** Send URL metacharacters in the input:\n   `#`, `?`, `&x=y`, `\u002F`, `..\u002F`, and encoded forms `%23`, `%3f`, `%26x=y`, `%2f`, `%2e%2e%2f`.\n   Distinct errors such as `Invalid route`, `API definition`, `unsupported field`, or changed returned\n   fields are routing hypotheses, not proof of server-side interpolation; compare controlled fixtures and inspect server behavior.\n3. **Use path traversal to move inside the server-side URL.** If `username\u002F..\u002Fother-user` changes the\n   referenced account, the input is in a REST path segment. Then try appending route fragments such as\n   `\u002Ffield\u002Femail`, `\u002Ffield\u002Fid`, `\u002Ffield\u002Fusername`, `\u002Ffield\u002FsyntheticCanary`, and terminate the rest\n   of the original backend path with `#` or `%23` when the backend URL parser honors fragments.\n4. **Discover API documentation from errors.** When an error says to consult the API definition, probe\n   common documentation\u002Fspec paths: `\u002Fopenapi.json`, `\u002Fswagger.json`, `\u002Fapi-docs`, `\u002Fapi\u002Fswagger.json`,\n   `\u002Fswagger\u002Fv1\u002Fswagger.json`, `\u002Fv3\u002Fapi-docs`, and path-traversal variants that attempt to reach the\n   spec from the vulnerable backend route. A spec or descriptive route error tells you valid resources\n   and field names.\n5. **Validate a controlled boundary.** Use two owner-controlled synthetic accounts and a harmless protected canary field. Do not retrieve another user’s reset token, complete takeover or send reset messages. An error difference alone is not evidence of data access.\n\nPayload patterns to try, adapted to the observed parameter name:\n\n```\nusername=administrator%23\nusername=administrator%3f\nusername=administrator%2f..%2fvictimuser\nusername=administrator\u002F..\u002Fvictimuser\nusername=administrator\u002Ffield\u002Femail%23\nusername=administrator\u002Ffield\u002Fid%23\nusername=administrator\u002Ffield\u002FsyntheticCanary%23\nusername=administrator%2ffield%2fpasswordResetToken%23\n```\n\n### CORS Exploitation\n```bash\n# Test: reflected origin + credentials\ncurl -s -I -H \"Origin: https:\u002F\u002Fcontrolled-origin.example\" https:\u002F\u002Ftarget.example\u002Fapi\u002Fuser\u002Fme\n# If: Access-Control-Allow-Origin: https:\u002F\u002Fcontrolled-origin.example + Access-Control-Allow-Credentials: true\n# → Candidate only: browser credentials, SameSite, preflight and readable sensitive body must be demonstrated with controlled identities\n```\n\n---\n\n## OData authorization and parser-boundary review\n\nOData query options can expose information or consume resources only when the actual\nservice’s authorization, parser or query-cost controls are inadequate. Do not assume\noperator casing\u002Fencoding equivalence, a WAF bypass, SQL injection, XXE or a current\nCVE from the presence of OData. Dialect\u002Fversion\u002Fprovider behavior differs.\n\nUse a tiny owner-approved sandbox with synthetic data:\n\n1. Establish the exact service\u002Fversion and an authenticated low-privilege identity.\n2. Create owned records A\u002FB with a protected synthetic `canary` field, documented\n   expected permissions and a reset path. Inspect the service schema as inert data.\n3. Compare `$select`, `$filter`, `$orderby` and `$expand` against expected field AND\n   related-object authorization. Do not use real password hashes, cards or PII.\n4. For example, if A cannot read `canary`, ordering\u002Ffiltering by it must not reveal\n   its value through a repeatable oracle. Document the controlled difference and\n   rule, not merely a response count.\n5. Test at most an approved small batch\u002Fnesting depth; bound work per inner operation\n   and preserve auth per subrequest. A parsing difference alone is not exploitation.\n\nNo destructive SQL, blind extraction loop or unlimited expansion is needed for a\nminimal report. Review the provider’s current security advisories and original\nresearch before claiming any historical version range, patch date or public case.\n\n## OpenAPI \u002F Swagger exposure\n\nPublic documentation may be intentional; it is not itself an authentication bypass,\ncomplete inventory or proof that every described operation is deployed. Fetch only\napproved bounded spec URLs, validate schema and treat operation descriptions,\nexternal `$ref` targets, servers and example URLs as untrusted data. Never automatically\nfeed every path to a scanner, execute “Try it out”, or follow third-party references.\n\nA useful static check is `jq '.paths | keys' approved-spec.json` on a private local\ncopy. Then compare a single owned synthetic object across authorized\u002Funauthorized\nidentities. Privileged writable DTO fields are candidates requiring persisted-state\nverification, not proof from a schema name or 200 status. Remote Swagger UI config\nloading\u002Fversion banners require current bundle configuration and advisory checks;\ndo not send crafted links to unsuspecting users. No public case, payout, CVE range\nor target behavior has been verified by these examples.\n\n## Related Skills & Chains\n\n- **`hunt-ato`** — Mass assignment on signup\u002Fprofile is the fastest path to admin. Chain primitive: API mass assignment + `hunt-ato` → `role=admin` set on signup → ATO via privileged role on first login.\n- **`hunt-auth-bypass`** — JWT flaws collapse the entire auth layer. Chain primitive: JWT `alg=none` + `hunt-auth-bypass` → impersonate any user by setting `sub` to victim ID, no signature required.\n- **`hunt-rce`** — Prototype pollution gadgets in Node.js dependencies (lodash, mongoose, jQuery) reach `child_process.spawn`. Chain primitive: Prototype pollution (`__proto__.shell=true`) + `hunt-rce` (Node.js gadget chain) → RCE on the API node.\n- **`hunt-subdomain`** — CORS regex with wildcard subdomain trusts a takeoverable host. Chain primitive: CORS allowlist `*.target.com` + subdomain takeover → attacker-controlled origin reads credentialed API responses.\n- **`security-arsenal`** — Load the JWT Attack Payloads section (alg=none, kid path traversal, JWK injection, embedded JWK) and the Mass-Assignment Field Wordlist (`is_admin`, `role`, `verified`, `permissions`, `org_id`, `tenant_id`).\n- **`triage-validation`** — Apply the Server-Policy-vs-State gate: a permissive CORS header alone is informational; demonstrate actual cross-origin credentialed read of sensitive data before reporting.\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; separately review official tool provenance and current compatibility before installation.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":36,"source":59,"license":14,"sources":60,"category":52,"date_added":61,"description":7,"source_repo":62,"source_type":42,"report_count":63,"compatibility":64,"license_source":65},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","hackerone_public, owasp_api_top10_2023, public_research","2026-09-20","elementalsouls\u002FClaude-BugHunter",0,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hunt-api-misconfig",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-12 14:21:24",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add boisenoise\u002Fskills-collections --skill hunt-api-misconfig",{"tool":78,"command":79},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hunt-api-misconfig",{"tool":81,"command":82},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hunt-api-misconfig","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hunt-api-misconfig\u002FSKILL.md",true,[],[87,114,138,160,178,200],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":92,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":54},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,46,104,105,43,106,107,108,109,110,111,112,113,31],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":124,"publishedAt":54},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[121],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[116,125,126,53,99,100,49,46,127,128,129,130,131,132,133,109,134,135,136,137,31],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":148,"publishedAt":54},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000038","人力资源",[140,53,99,49,48,149,150,151,152,153,109,154,155,156,135,33,157,158,159,137,116,31],"email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":164,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":54},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[168,169,170,53,99,49,171,172,48,173,127,174,175,44,152,109,176,177,137,116,31],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","observations","company",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":182,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":54},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[186,187,53,51,99,188,49,189,190,191,192,193,109,194,195,196,197,198,199,137],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":91,"licenseFileUrl":204,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":54},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[208,209,210,53,99,49,211,212,151,213,214,109,215,216,217,218,219,220,221,137],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]