skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-api-misconfig

Detect API security misconfigurations including mass assignment, JWT attacks, and CORS issues.

5|Updated May 27, 2026
Search Tags:#vulnerability detection#api security#mass assignment#cors bypass#jwt attack
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-api-misconfig-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-api-misconfig
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/hunt-api-misconfig
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-api-misconfig-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and addresses common API security misconfigurations, such as mass assignment, JWT attacks, prototype pollution, CORS issues, and HTTP verb tampering, enhancing overall API security.

Core Features & Use Cases

  • Mass Assignment Detection: Identifies and prevents unauthorized privilege escalation through mass assignment vulnerabilities.
  • JWT Attack Detection: Discovers and mitigates JWT-related vulnerabilities like weak HMAC, token confusion, and path traversal.
  • Prototype Pollution Detection: Detects prototype pollution vulnerabilities in JSON merge and object assignment operations.
  • CORS Bypass Detection: Identifies CORS misconfigurations that allow unauthorized cross-origin requests.
  • HTTP Verb Tampering Detection: Discovers and mitigates HTTP verb tampering vulnerabilities like GET-bypass-CSRF and TRACE enabled.
  • Use Case: For example, it can automatically detect and report a mass assignment vulnerability in an API endpoint, preventing potential data breaches.

Quick Start

Use the hunt-api-misconfig skill to scan your API for common security misconfigurations.

Frequently Asked Questions about hunt-api-misconfig

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect API security misconfigurations like mass assignment and CORS bypass?▼

API security misconfigurations like mass assignment and CORS bypass are detected by analyzing API responses and headers to identify unauthorized privilege escalation and cross-origin requests.

What is a JWT attack and how does it impact API security?▼

A JWT attack exploits vulnerabilities like weak HMAC, token confusion, or path traversal in JSON Web Tokens to compromise API security and gain unauthorized access.

How do I check for prototype pollution in JSON merge operations?▼

To check for prototype pollution in JSON merge operations, analyze object assignment and merge processes to detect if attackers can inject properties into the prototype chain.

Does this API vulnerability detection work for penetration testing audits?▼

Yes, API vulnerability detection applies directly to security audits and penetration testing by scanning endpoints for HTTP verb tampering, JWT attacks, and CORS issues.

How do I prevent HTTP verb tampering like GET-bypass-CSRF in my API?▼

To prevent HTTP verb tampering like GET-bypass-CSRF, scan your API endpoints to detect misconfigurations such as enabled TRACE methods and improper verb authorization.

Why does my API endpoint allow unauthorized cross-origin requests?▼

Your API endpoint allows unauthorized cross-origin requests due to CORS misconfigurations, which fail to properly restrict access control headers and validate origin domains.

Related Skills

Explore More Software Engineering Skills→
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic
saeed-vayghansaeed-vayghan
30

penetration-tester

Identify and validate security weaknesses in web applications, networks, and APIs.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-api-misconfig

Detect API security misconfigurations including mass assignment, JWT attacks, and CORS vulnerabilities.

Community
Advanced
proffesor-for-testingproffesor-for-testing
436

security-testing

Test software security vulnerabilities using OWASP principles.

Community
Advanced