api-fuzzing-bug-bounty
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
Target: Cloud, operations & security. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- API Fuzzing for Bug Bounty
- Purpose
- Inputs/Prerequisites
- Outputs/Deliverables
- API Types Overview
- Core Workflow
- Step 1: API Reconnaissance
- Step 2: Authentication Testing
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors. Burp Suite or similar proxy tool API wordlists (SecLists, apiwordlist) Understanding of REST/GraphQL/SOAP protocols Python for scripting Target API endpoints and documentation (if available) Identified API vulnerabilities IDOR exploitation proofs Authentication bypass techniques SQL injection points Unauthorized data access documentation -- | Type | Protocol | Data Format | Structure | |------|----------|-------------|-----------| | SOAP | HTTP | XML | Header + Body | | REST | HTTP | JSON/XML/URL | Defined endpoints | | GraphQL | HTTP | Custom Query | Single endpoint | -- Identify API type and enumerate endpoints: Insecure Direct Object Reference is the most common API vulnerability: IDOR Bypass Techniques: SQL Injection in JSON: Command Injection: XXE Injection: SSRF via API: .NET Path.Combine Vulnerability: -- Fetch entire backend schema: URL-encoded version: | Tool | Purpose | |------|---------| | GraphCrawler | Schema discovery | | graphw
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- davila7/claude-code-templates
- Source file
- cli-tool/components/skills/security/api-fuzzing-bug-bounty/SKILL.md
- Fixed revision
- 21be197f100a12b8d0dd9a211cc244c8179f84d3
Requirements
- Only the author’s Skill metadata is included. Read the full instructions to check dependencies, licensing and conditions of use.
A small first task
先阅读原作者说明，再决定是否在自己的 AI 工具中使用。
Instructions for your AI tool
- Claude Desktop: resource-specific guide not available yet
- Claude Code: resource-specific guide not available yet
- Cursor: resource-specific guide not available yet
- Codex: resource-specific guide not available yet
Author documentation is not live verification by this site. Without evidence, we do not mark a resource as compatible, safe or free.
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: davila7/claude-code-templates · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-09T15:01:40.468Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.