skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

api-fuzz

Automate API security testing with endpoint discovery and semantic fuzzing.

1.6k|234|Updated Dec 7, 2019
Search Tags:#testing#security#api#openapi#rest#graphql#fuzzing
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill api-fuzz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-fuzz
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/api-fuzz
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill api-fuzz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

API security testing can be manual, time-consuming, and prone to missed vulnerabilities. This Skill provides a structured methodology to automate discovery, targeted fuzzing, and evidence-driven assessment for REST/GraphQL APIs.

Core Features & Use Cases

  • API endpoint discovery and map generation from Swagger/OpenAPI or live traffic.
  • Authentication and authorization testing, including token handling and access control checks.
  • Semantic fuzzing with parameter-aware payloads and phased testing (discovery -> fuzz -> validate).
  • Evidence collection and vulnerability mapping for reporting and remediation planning.

Quick Start

Provide an initial set of API endpoints and an OpenAPI spec to begin semantic fuzzing.

Frequently Asked Questions about api-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate API security testing for REST and GraphQL services?▼

Automate API security testing by guiding endpoint discovery, authentication checks, and intelligent fuzzing across REST and GraphQL services to map vulnerabilities and generate evidence-ready reports.

What is semantic fuzzing and how does it apply to OpenAPI endpoints?▼

Semantic fuzzing applies parameter-aware payloads to API endpoints discovered from OpenAPI specifications, validating responses through structured phases to identify security vulnerabilities accurately.

Can I test authentication and access control vulnerabilities in my API?▼

Yes, you can test authentication and authorization vulnerabilities by automating token handling and access control checks to ensure endpoints are properly secured against unauthorized access.

How do I discover API endpoints from Swagger documentation for vulnerability mapping?▼

Discover API endpoints by parsing Swagger or OpenAPI documentation to generate an endpoint map, which then serves as the foundation for targeted fuzzing and vulnerability mapping.

Do I need an OpenAPI spec to start API fuzzing?▼

Providing an initial set of API endpoints and an OpenAPI specification is the quick start method for beginning semantic fuzzing, though discovered endpoints from live traffic also work.

What is the best way to collect evidence for API security remediation?▼

The best way to collect remediation evidence is through structured vulnerability mapping and evidence-driven assessment phases that document discovered flaws for clear reporting and planning.

Related Skills

Explore More Software Engineering Skills→
jhlee0409jhlee0409
4

openapi-parser

Parse OpenAPI 3.x and Swagger 2.0 specs into structured endpoint catalogs.

Community
Advanced
dapperdiversdapperdivers
1

report-generator

Generate structured markdown penetration test reports from JSON security scan findings.

Community
Intermediate
trilwutrilwu
109

testing-apis

Identify and exploit API security weaknesses across REST and GraphQL endpoints.

Community
Advanced
jinyimeng01jinyimeng01
54

api-fuzz

Select semantic fuzzing payloads for API parameters based on attack patterns.

Community
Intermediate