What problem does it solve? When testing APIs behind gateways like Kong, Envoy, or AWS API Gateway, identical-looking 401/403/404 responses can come from either the gateway or the upstream app, leading to opposite conclusions about whether a route exists, is protected, or is vulnerable. This Skill provides a methodology to attribute each response to the correct layer before interpreting it. ## Core Features & Use Cases - Layer signature identification: Recognize gateway-authored error bodies (Kong, Envoy, AWS API Gateway) versus application responses using body patterns, timing headers like x-kong-upstream-latency, and response timing. - Ungated route detection: Identify routes missing auth plugins by pairing suspected-ungated routes with known-gated control routes on the same prefix. - False-positive avoidance: Interpret application-layer 400/500 responses as proof of reach rather than rejection, and avoid misreading AWS API Gateway's "Missing Authentication Token" as an auth finding. - Use Case: During an authorized API assessment, you receive a 404 on a candidate endpoint. Use this Skill to determine whether the gateway has no such route or the app returned the 404, then decide whether to fuzz, recover parameters, or report an ungated route. ## Quick Start Analyze these captured API responses and tell me whether each came from the gateway or the upstream application, and whether any route is ungated.
