skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-schema-enumeration

Identify hidden database tables and API endpoints from structured error responses.

3|1|Updated Jul 2, 2026
Search Tags:#security#api#graphql#enumeration#fuzzing#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-schema-enumeration-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-schema-enumeration
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-schema-enumeration
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-schema-enumeration-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of black-box API reconnaissance by leveraging structured error messages to map out hidden database tables, fields, and internal endpoints.

Core Features & Use Cases

  • Error Hint Mining: Automatically parses JSON error responses from frameworks like PostgREST, FastAPI, and Zod to reveal schema details.
  • Introspection Exploitation: Identifies GraphQL schema structures even when standard introspection is disabled.
  • Targeted Fuzzing: Generates and executes wordlists based on domain-specific patterns to confirm table existence and structure.

Quick Start

Use the hunt-schema-enumeration skill to analyze the target API at https://api.example.com for hidden database fields and table names.

Frequently Asked Questions about hunt-schema-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate hidden database tables and fields in a black-box API?▼

To enumerate hidden database tables and fields in a black-box API, you analyze structured JSON error responses from web frameworks. This technique parses error hints from frameworks like PostgREST and FastAPI to reveal internal schema details without direct database access.

Can I map a GraphQL schema when standard introspection is disabled?▼

You can map a GraphQL schema with standard introspection disabled by exploiting error-based information leakage. Analyzing structured error responses returned by the server helps identify underlying schema structures and hidden fields.

Do I need curl and python3 to fuzz API endpoints for schema reconnaissance?▼

Yes, you need curl and python3 to fuzz API endpoints for schema reconnaissance. These tools are required to execute fuzzing requests against the target API and parse the JSON error hints returned during the scanning process.

What is the best way to extract API schema details from framework error messages?▼

The best way to extract API schema details from framework error messages is through targeted fuzzing. By generating domain-specific wordlists and sending requests to the API, you trigger and parse JSON errors that confirm table existence and data structure.

Does error analysis work for discovering hidden endpoints in REST and RPC APIs?▼

Error analysis works for discovering hidden endpoints in REST and RPC APIs by analyzing structured error responses. This black-box assessment method maps internal data structures and identifies undocumented endpoints across REST, GraphQL, and RPC architectures.

Related Skills

Explore More Software Engineering Skills→
kngender5kngender5

arxiv

Search arXiv papers by keyword, author, category, or ID and retrieve details.

Community
Intermediate
Ed1s0nZEd1s0nZ
5.6k

xss-testing

Test web applications for reflected, stored, and DOM-based XSS vulnerabilities.

Community
Intermediate
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
AeonDaveAeonDave
15

gobuster

Enumerate directories, DNS subdomains, and virtual hosts on web servers.

Community
Intermediate