skills.rest
lycheer1126
lycheer1126COMMUNITY
Explore all skills by this author →
GitHub

api-fuzz

Generates semantic-type-based API fuzzing payloads for IDOR, SQLi, XSS, SSRF, SSTI, and command injection testing.

2|1|Updated Aug 28, 2026
Search Tags:#penetration testing#sqli#payloads#ssrf#idor#api fuzzing#parameter discovery
One-click install
npx skills add https://github.com/lycheer1126/xs-bigdan --skill api-fuzz-lycheer1126
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-fuzz
Source: https://github.com/lycheer1126/xs-bigdan/tree/main/knowledge/skills/api_fuzz
Command: npx skills add https://github.com/lycheer1126/xs-bigdan --skill api-fuzz-lycheer1126

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Blind fuzzing wastes requests on irrelevant payloads. This Skill maps API parameters to their semantic types (ID, URL, search query, template, command, amount) so testers select targeted payloads that match how each parameter is actually processed by the backend. ## Core Features & Use Cases - Semantic Payload Selection: Provides curated payload sets for ID/number, URL/path/file, search/query, template/content, command, and amount/price parameter types covering IDOR, SQLi, XSS, SSRF, SSTI, command injection, and business logic flaws. - Parameter Discovery Methods: Includes three techniques for finding hidden parameters—appending candidate params and comparing response sizes, sending empty JSON to leak field names from error messages, and switching Content-Type between JSON, XML, and form encoding. - Use Case: During authorized penetration testing of a REST API, identify that an endpoint accepts an id parameter, then apply the ID-type payloads (id[$gt]=0, id[]=1&id[]=2, negative and null values) to probe for NoSQL injection and IDOR vulnerabilities. ## Quick Start Ask the agent to fuzz the discovered API endpoint parameters using the semantic payload templates matched to each parameter type.

Frequently Asked Questions about api-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fuzz API parameters for vulnerabilities?▼

First classify each parameter by semantic type (ID, URL, search, template, command, amount), then apply the matching payload set. For example, test ID parameters with NoSQL operators like id[$gt]=0 and array injection like id[]=1&id[]=2 to probe for IDOR and injection flaws.

How to discover hidden API parameters during testing?▼

Three methods work well: append common parameter names and compare response byte sizes, send an empty JSON POST body to trigger error messages that leak required field names, and switch Content-Type between JSON, XML, and form encoding to see which parsers accept extra fields.

What SSRF payloads should I test on URL parameters?▼

Test loopback addresses like http://127.0.0.1 and http://[::1], cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ for AWS and http://metadata.google.internal/ for GCP, plus alternative schemes like file://, gopher://, and dict://.

Can semantic fuzzing detect business logic vulnerabilities?▼

Yes, amount, price, and quantity parameters get dedicated payloads such as amount=0, amount=-1, price=0.00, and quantity=999999. These probe whether the server validates numeric boundaries or allows negative pricing and integer overflow conditions.

When should I use semantic payloads instead of a full fuzzing wordlist?▼

Use semantic payloads when you know the parameter's role, since targeted payloads produce clearer signals with far fewer requests. Large generic wordlists are better suited for initial endpoint discovery rather than deep parameter-level vulnerability testing.

Related Skills

Explore More Software Engineering Skills→
warterbiliwarterbili

mitm-capture

Intercept and analyze Android and iOS mobile app network traffic with mitmproxy.

Community
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
woohyun212woohyun212
21

waf-detect

Detects Web Application Firewall presence and identifies product via wafw00f or curl.

Community
Intermediate
six2dezsix2dez
1.4k

burp-scan

Coordinate Burp Suite scans via MCP for vulnerability identification.

Community
Advanced