skills.rest
abisheikM1
abisheikM1COMMUNITY
Explore all skills by this author →
GitHub

api-pivot

Tests server-side API vulnerabilities discovered through Android app traffic interception.

48|27|Updated Jul 30, 2026
Search Tags:#jwt#api security#idor#burp suite#owasp api top 10#ssl pinning bypass#android pentest
One-click install
npx skills add https://github.com/abisheikM1/Tribunal --skill api-pivot-abisheikm1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-pivot
Source: https://github.com/abisheikM1/Tribunal/tree/main/legacy-harness/skills/api-pivot
Command: npx skills add https://github.com/abisheikM1/Tribunal --skill api-pivot-abisheikm1

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Mobile app pentesters often stop at client-side findings, but the highest-impact bugs live on the backend API the app talks to. This Skill turns endpoints, tokens, and keys discovered in an APK into a prioritized, in-scope server-side test plan covering the OWASP API Security Top 10. ## Core Features & Use Cases - Target Discovery: Parses secrets.json (http_endpoint, firebase_db, s3_bucket, gcs_bucket categories) into a deduplicated, prioritized host list with per-host API Top 10 checklists and scope reminders. - 14-TTP Methodology: Step-by-step test guidance for IDOR/BOLA, broken auth, mass assignment, rate limiting, JWT flaws, GraphQL abuse, SSRF, XXE, file upload, and client-side-only premium gates. - Cross-Skill Chaining: Combines with apk-recon (hardcoded keys), local-auth-audit (client-side gates), and deeplink-audit (OAuth tokens) to build multi-step exploit chains. - Use Case: After bypassing SSL pinning on an authorized test app, intercept its traffic in Burp, then use the generated target list to test each API host for IDOR by swapping object IDs between two accounts. ## Quick Start Run the api-pivot target builder against my APK's secrets.json to list the backend hosts I should test for IDOR and broken access control.

Frequently Asked Questions about api-pivot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an Android app's backend API for vulnerabilities?▼

Intercept the app's traffic in Burp after bypassing SSL pinning, then test each observed endpoint like a web API target. This Skill generates a prioritized host list from secrets.json and attaches the OWASP API Top 10 checklist per host.

How to find IDOR vulnerabilities in mobile app APIs?▼

Log in as one user, capture a request containing an object ID such as /orders/1001, then swap the ID to another user's object in Burp Repeater. If the server returns the other user's data, broken object level authorization is confirmed.

What input does the build_api_targets.py script need?▼

It reads targets/<hash>/secrets.json produced by scan_secrets.py, extracting hosts from http_endpoint, firebase_db, gcs_bucket, and s3_bucket regex hits. You can pass either --hash <sha256> or --secrets <path> directly.

Does this tool send automated requests to API endpoints?▼

No. The script only generates a test plan and never sends requests itself. Every probe is a single, human-reviewed, non-destructive request run manually in Burp Repeater against confirmed in-scope hosts.

Why is SSL pinning bypass required before API testing?▼

Without bypassing pinning, the app's HTTPS traffic cannot be observed in Burp, so endpoints and tokens stay hidden. Pinning bypass is an enabler owned by the android-frida-dynamic skill, not a finding itself.

Related Skills

Explore More Software Engineering Skills→
monmacllcappmonmacllcapp

firebase-apk-scanner

Scan Android APK files for Firebase security misconfigurations.

Official
Advanced
Harvest-Forged-CodeHarvest-Forged-Code
10

security-audit

Audit codebases for OWASP Top 10 vulnerabilities, hardcoded secrets, and vulnerable dependencies.

Official
Advanced
Yenn503Yenn503
1

performing-mobile-app-certificate-pinning-bypass

Bypass SSL certificate pinning in Android and iOS apps using Frida and Objection.

Community
Intermediate
TekLabsVNTekLabsVN
1

web-to-mobile

Convert an existing web project into an Expo mobile app with wired authentication.

Official
Advanced