What problem does it solve?
It helps security hunters quickly identify and validate high-impact API security misconfigurations that enable privilege escalation, account takeover, cross-origin data exposure, and other systemic auth/data-leak failures.
Core Features & Use Cases
- Mass assignment & privilege escalation: Detects endpoints that blindly apply user-controlled fields (for example, turning a normal user into admin by submitting role or verification flags).
- JWT weaknesses & token manipulation: Finds and tests common JWT flaws such as alg=none acceptance, algorithm confusion (e.g., RS256 vs HS256), and token/header manipulation vectors.
- Prototype pollution, CORS, and HTTP verb attacks: Identifies JSON/object merge pollution paths, CORS credentialed misconfigurations, and HTTP method tampering that can bypass intended protections.
Use case example: A target application’s API returns “extra” fields in responses and accepts attacker-injected JWT claims; use this Skill to validate misconfiguration impact and produce a structured vulnerability path with evidence.
Quick Start
Use the hunt-api-misconfig skill against the target API by requesting a focused misconfiguration report with mass-assignment tests, JWT validation checks, and CORS/verb-tampering evidence.
