skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-shadow-api

Enumerate API version history and behaviorally diff old versus current endpoints for security regressions.

Updated Sep 6, 2026
Search Tags:#penetration testing#api security#bug bounty#swagger diffing#version enumeration#shadow api#owasp api9
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-shadow-api-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-shadow-api
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-shadow-api
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-shadow-api-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Old, deprecated, or undocumented API versions often stay reachable without receiving the security fixes applied to the current version, creating shadow and zombie endpoints that attackers can exploit. This Skill provides a structured workflow to find those forgotten surfaces and prove the security-relevant differences. ## Core Features & Use Cases - Version Surface Enumeration: Probe path-based, header-based, and subdomain-based API versioning to map every live version of a target's API. - Spec Discovery and Diffing: Pull current and archived OpenAPI/Swagger specs (including via the Wayback Machine) and diff endpoint inventories to find zombie routes. - Behavioral Regression Testing: Compare auth strength, rate limiting, input validation, and field exposure between old and current versions of the same operation. - Use Case: During a bug bounty engagement, you notice a target serves both /api/v1/ and /api/v2/. Use this Skill to confirm v1 is still live, diff its Swagger spec against v2, and discover that v1 accepts expired tokens and lacks rate limiting on the login endpoint. ## Quick Start Ask the AI to enumerate all reachable API versions on the target host and behaviorally diff the oldest live version against the current one for auth, rate-limit, and validation regressions.

Frequently Asked Questions about hunt-shadow-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find shadow or zombie API endpoints on a target?▼

Enumerate versioned paths like /api/v1/ and /api/v2/, test header-based versioning with X-API-Version or Accept headers, and probe versioned subdomains. Then pull every reachable OpenAPI/Swagger spec, including archived copies from the Wayback Machine, and diff their endpoint inventories.

How to test old API versions for security regressions?▼

Send identical requests to the same operation on both versions and compare security behavior, not response shape. Test whether the old version accepts expired or lower-privilege tokens, lacks rate limiting, accepts payloads the new version rejects, or leaks fields the new version redacts.

What is OWASP API9 Improper Inventory Management?▼

It is an OWASP API Security Top 10 risk where organizations lose track of old API versions, internal routes, and staging endpoints. These forgotten surfaces remain reachable without receiving current security fixes, making them weaker than the documented production API.

When should I not use shadow API version diffing?▼

Skip it when the target has a single API version with no version history, since there is nothing to diff. In that case, go directly to general API misconfiguration testing such as mass assignment, JWT attacks, or injection against the one existing surface.

Does a different response between API versions count as a vulnerability?▼

No. A version difference alone, such as renamed fields or changed response shape, is informational only. A valid finding requires a security-relevant regression: weaker authentication, missing rate limits, removed input validation, or extra sensitive field exposure in the older version.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

api-recon-and-docs

Discover API endpoints, schemas, versions, and hidden documentation paths.

Community
Intermediate
RifteoRifteo
30

compliance-gap-analyzer

Categorize and prioritize compliance gaps against ISO frameworks from audit findings.

Official
Advanced
overtimepogovertimepog

js-analysis

Analyze JavaScript bundles to extract source maps, API endpoints, and secrets.

Community
Advanced
pdparchitectpdparchitect
13

hunt-api-misconfig

Identify and validate API security misconfigurations including mass assignment, JWT flaws, and CORS bypasses.

Community
Advanced