skills.rest
cmndcntrlcyber
cmndcntrlcyberCOMMUNITY
Explore all skills by this author →
GitHub

hunt-api-misconfig

Detect API security misconfigurations including mass assignment, JWT attacks, and CORS vulnerabilities.

3|Updated Nov 12, 2025
Search Tags:#api security#mass assignment#prototype pollution#http verb tampering#jwt attacks#cors vulnerabilities
One-click install
npx skills add https://github.com/cmndcntrlcyber/rtpi --skill hunt-api-misconfig-cmndcntrlcyber
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-api-misconfig
Source: https://github.com/cmndcntrlcyber/rtpi/tree/main/knowledge_seed/bug_hunter_skills/hunt-api-misconfig
Command: npx skills add https://github.com/cmndcntrlcyber/rtpi --skill hunt-api-misconfig-cmndcntrlcyber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and mitigates API security misconfigurations, including mass assignment, JWT attacks, prototype pollution, CORS, and HTTP verb tampering.

Core Features & Use Cases

  • API Security Misconfiguration Detection: Identifies issues like mass assignment, JWT flaws, prototype pollution, CORS vulnerabilities, and HTTP verb tampering.
  • Mass Assignment: Detects mass assignment vulnerabilities by sending malicious payloads and analyzing server responses.
  • JWT Attacks: Discovers JWT vulnerabilities like weak HMAC, token confusion, and path traversal.
  • Prototype Pollution: Identifies prototype pollution vulnerabilities in JSON merge operations and JavaScript objects.
  • CORS Exploitation: Detects CORS misconfigurations that allow unauthorized access to credentials.
  • HTTP Verb Tampering: Detects GET-bypass-CSRF, X-HTTP-Method-Override, and TRACE vulnerabilities.
  • Use Case: When performing a security audit on an API, use this Skill to uncover and fix potential security vulnerabilities.

Quick Start

Use the hunt-api-misconfig skill to scan the 'api-endpoints' directory for common security misconfigurations.

Frequently Asked Questions about hunt-api-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How can I automate API security misconfiguration detection during a penetration test?▼

To detect mass assignment vulnerabilities, send malicious payloads to API endpoints and analyze the server responses. This skill automates this process by probing parameters to see if the server improperly binds untrusted input to internal objects.

How do I test my API for JWT attacks and token vulnerabilities?▼

Testing for JWT attacks involves discovering vulnerabilities like weak HMAC, token confusion, and path traversal. This skill automates the discovery process, analyzing token handling to identify weaknesses in JWT implementation during security audits.

Can I detect prototype pollution vulnerabilities in JSON merge operations?▼

Yes, you can detect prototype pollution vulnerabilities in JSON merge operations and JavaScript objects. The skill identifies these flaws by testing how API endpoints process and merge untrusted JSON input, exposing potential injection risks.

What is the best way to scan an API for CORS and HTTP verb tampering vulnerabilities?▼

The best way to scan for CORS and HTTP verb tampering is to automate detection of unauthorized cross-origin access and method override flaws. This skill identifies misconfigured CORS headers and tests for GET-bypass-CSRF and TRACE vulnerabilities.

Do I need a specific API directory structure to run a security audit?▼

You should provide an api-endpoints directory structure to scan for common security misconfigurations. The skill is designed to analyze these directories, making it suitable for security audits and penetration testing workflows.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

source-code-scanning

Automate source code security scanning for vulnerabilities, CVEs, and hardcoded secrets.

Community
Advanced
vecearvecear

dependency-vulnerability-triage

Convert npm audit and Snyk reports into prioritized patch plans.

Community
Advanced
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced
Ed1s0nZEd1s0nZ
5.6k

mobile-app-security-testing

Analyze Android and iOS applications for security vulnerabilities using static and dynamic techniques.

Community
Advanced