api-fuzz

Select semantic fuzzing payloads for API parameters based on attack patterns.

54|5|Updated May 9, 2026

Search Tags:#api #security testing #injection #fuzzing #payloads #idor

Ready to run

npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill api-fuzz-jinyimeng01

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-fuzz
Source: https://github.com/jinyimeng01/mastermind-bug-bounty/tree/main/skills/api_fuzz
Command: npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill api-fuzz-jinyimeng01

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security testers avoid inefficient blind fuzzing by selecting API vulnerability payloads based on parameter semantics and common attack patterns.

Core Features & Use Cases

Semantic Payload Selection: Provides targeted payload templates for IDs, URLs, queries, templates, commands, and business logic parameters.
API Vulnerability Testing: Supports security assessment scenarios covering IDOR, SQL injection, XSS, SSRF, SSTI, command injection, and logic flaws.
Use Case: A bug bounty researcher analyzing an API endpoint can use this Skill to choose relevant test inputs based on discovered parameter types instead of sending random payloads.

Quick Start

Use the api-fuzz skill to select suitable fuzzing payloads for the API parameters discovered during a security assessment.

Frequently Asked Questions about api-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I select the right API fuzzing payloads for discovered parameters?▼

To select API fuzzing payloads effectively, you need to match payload templates to parameter semantics like IDs, URLs, queries, commands, and business logic. This targeted approach avoids inefficient blind fuzzing during security testing.

What is semantic fuzzing for API security testing?▼

Semantic fuzzing for API security testing is the process of choosing test inputs based on the meaning and type of discovered parameters. It replaces sending random payloads with targeted templates for specific attack categories like IDOR and SQL injection.

Does semantic payload selection work for IDOR and injection testing?▼

Yes, semantic payload selection works for IDOR and injection testing by providing organized templates covering access control weaknesses and common injection flaws. This includes targeted inputs for SSRF, SSTI, XSS, and command injection vulnerabilities.

How do I test API endpoints for IDOR and logic flaws during bug bounty assessments?▼

To test API endpoints for IDOR and logic flaws during bug bounty assessments, apply semantic fuzzing payloads based on discovered parameter types. This allows you to choose relevant test inputs for access control weaknesses instead of relying on random fuzzing.

Can I use this API fuzzing approach without predefined payload templates?▼

No, this API fuzzing approach requires organized payload templates covering multiple attack categories and parameter discovery scenarios. Without these predefined templates, you cannot effectively perform semantic payload selection for targeted vulnerability testing.

What is the best way to cover multiple API attack categories during penetration testing?▼

The best way to cover multiple API attack categories during penetration testing is to use semantic payload selection. By applying organized templates for common injection and access control weaknesses, testers can efficiently target discovered parameters.