api-recon-and-docs
starsforks
How to install api-recon-and-docs?
shulkwisec/bb-huge/api-recon-and-docs
$npx -y skills add ShulkwiSEC/bb-huge --skill api-recon-and-docsAPI reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.
SKILL.md
| 1 | # SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation. |
| 4 | |
| 5 | ## 1. PRIMARY GOALS |
| 6 | |
| 7 | 1. Discover all reachable API entrypoints. |
| 8 | 2. Extract schemas, optional fields, and role differences. |
| 9 | 3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters. |
| 10 | |
| 11 | ## 2. RECON CHECKLIST |
| 12 | |
| 13 | ### JavaScript and client mining |
| 14 | |
| 15 | ```bash |
| 16 | curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u |
| 17 | ``` |
| 18 | |
| 19 | ### Common documentation and schema paths |
| 20 | |
| 21 | ```text |
| 22 | /swagger.json |
| 23 | /openapi.json |
| 24 | /api-docs |
| 25 | /docs |
| 26 | /.well-known/ |
| 27 | /graphql |
| 28 | /gql |
| 29 | ``` |
| 30 | |
| 31 | ### Version and product drift |
| 32 | |
| 33 | ```text |
| 34 | /api/v1/ |
| 35 | /api/v2/ |
| 36 | /api/mobile/v1/ |
| 37 | /legacy/ |
| 38 | ``` |
| 39 | |
| 40 | ## 3. WHAT TO EXTRACT FROM DOCS |
| 41 | |
| 42 | - optional and undocumented fields |
| 43 | - admin-only request examples |
| 44 | - deprecated endpoints that may still be active |
| 45 | - schema hints like `additionalProperties: true` |
| 46 | - parameter names tied to filtering, sorting, IDs, roles, or tenancy |
| 47 | |
| 48 | ## 4. NEXT ROUTING |
| 49 | |
| 50 | | Finding | Next Skill | |
| 51 | |---|---| |
| 52 | | object IDs everywhere | [api authorization and bola](../api-authorization-and-bola/SKILL.md) | |
| 53 | | JWT, OAuth, role claims | [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md) | |
| 54 | | GraphQL or hidden fields | [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md) | |
| 55 | | strong auth boundary but suspicious business flow | [business logic vulnerabilities](../business-logic-vulnerabilities/SKILL.md) | |
People who liked this also viewed
6 picksType
- grill-with-docsA relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.SkillsJul 2026
- lark-minutes飞书妙记：搜索妙记、查看妙记基础信息、下载/上传音视频、读取或编辑妙记的产物内容、改标题、替换说话人/关键词、申请妙记查看/编辑权限。当给出minute_token、本地音视频文件，要查/改/转妙记产物，或用户明确要主动申请妙记权限时使用；本地音视频转纪要/逐字稿优先走本 skill，不要用 ffmpeg/whisper 本地转写。不负责：获取会议关联妙记，或仅按自然语言标题定位纪要SkillsJul 2026
- lark-markdown飞书 Markdown：查看、创建、上传、编辑和比较 Markdown 文件。当用户需要创建或编辑 Markdown 文件、读取、修改、局部 patch 或比较差异时使用。不负责将 Markdown 导入为飞书在线文档，也不负责文件搜索、权限、评论、移动、删除等云空间管理操作。SkillsJul 2026
- docxUse this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', SkillsJul 2026
- edit-articleSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- lark-note飞书会议纪要（Note）直查：已知 note_id 时查询纪要详情、展示类型、关联文档 token，并读取 unified 原始逐字记录。当用户已持有 note_id，或从文档显式 vc-node-id 获得 note_id 时使用。不负责会议/日程/妙记定位、文档标题搜索或 Docx 正文读取。SkillsJul 2026
