Individual skill

api-fuzzing

Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec, or "map/fuzz the API". Signals: /api, /v1, swagger.json, GraphQL, mobile backend, undocumented routes.

skills/api/api-fuzzing/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
engineering Derived category
docs Derived category
docs-api Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 2,216 bytes

Read excerpt


# API discovery & fuzzing

## When it applies
You need the API's real surface before attacking it: hidden endpoints, accepted methods, extra
params, and old versions. Complete inventory is where BOLA/mass-assignment/auth bugs surface.

## Why it works
APIs expose far more than the client uses; specs, JS, and mobile apps reveal routes, and
version drift leaves un-patched endpoints. Enumerating the surface turns guesswork into targeted testing.

## Method
1. **Harvest from specs/clients**: OpenAPI/Swagger (`swagger.json`, `/api-docs`), Postman
   collections, GraphQL introspection, and endpoints in JS bundles / mobile apps.
2. **Route brute**: `kiterunner` (API-aware wordlists incl. methods) or `ffuf` against `/api/FUZZ`,