skills.rest
philo-groves
philo-grovesCOMMUNITY
Explore all skills by this author →
GitHub

maxtac-web-api-fuzzing

Fuzz stateful web API request sequences to discover security vulnerabilities.

12|Updated Jun 1, 2026
Search Tags:#vulnerability assessment#web testing#api security#fuzzing#stateful testing
One-click install
npx skills add https://github.com/philo-groves/MaxTAC --skill maxtac-web-api-fuzzing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: maxtac-web-api-fuzzing
Source: https://github.com/philo-groves/MaxTAC/tree/main/plugins/maxtac-web/skills/maxtac-web-api-fuzzing
Command: npx skills add https://github.com/philo-groves/MaxTAC --skill maxtac-web-api-fuzzing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill solves the problem of inadequate web API security testing by providing stateful fuzzing, which is essential for identifying vulnerabilities in APIs that rely on the sequence of requests and responses.

Core Features & Use Cases

  • Stateful Request Fuzzing: Supports stateful request fuzzing, schema-backed fuzzing, parameter fuzzing, and captured HTTP replay.
  • Logic-Oracle Evidence: Generates evidence that includes API spec, GraphQL schema, HAR/curl replay, auth context, and relevant logs for in-depth analysis.
  • Use Case: Consider an e-commerce application. Use this Skill to fuzz the payment API, ensuring that it handles various sequences of payment requests without introducing vulnerabilities like timing attacks or sensitive data leaks.

Quick Start

Execute the fuzz-campaign script with the target API endpoint and relevant parameters:

python3 <skill-dir>/scripts/fuzz-campaign.py init \
  --target "payment API endpoint" \
  --target-version "v1.2.3" \
  --tool Schemathesis \
  --scope "authorized staging tenant"

Frequently Asked Questions about maxtac-web-api-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is stateful web API fuzzing and when do I need it?▼

Stateful web API fuzzing sends sequences of dependent requests to an API to verify security invariants are preserved across interactions. You need it when testing APIs that rely on request sequences, such as payment processing, to uncover logic-based vulnerabilities.

How do I run a stateful fuzzing campaign against a versioned API endpoint?▼

Run the provided Python fuzz-campaign script, passing the target endpoint URL, API version, testing tool like Schemathesis, and tenant scope. This initializes the stateful fuzzing process, capturing and replaying HTTP request sequences against the specified API.

Can I use captured HTTP replay and curl with this API security testing approach?▼

Yes, the fuzzing approach supports captured HTTP replay using HAR and curl inputs alongside schema-backed and parameter fuzzing. This allows you to reproduce specific request sequences and validate API behavior against authentic authentication contexts.

Does API fuzzing require Python and specific authentication contexts to operate?▼

Yes, Python is required for executing the integration scripts and running the fuzzing campaign. You must also define a specific scope, such as an authorized staging tenant, to ensure the fuzzing operates within a valid authentication context.

What evidence does stateful API fuzzing generate for vulnerability analysis?▼

Stateful API fuzzing generates logic-oracle evidence that includes the API specification, GraphQL schema, HAR or curl replay data, authentication context, and relevant logs. This output provides comprehensive context for in-depth vulnerability analysis.

Related Skills

Explore More Software Engineering Skills→
ThrookieThrookie
2

api-pattern-extractor

Extract API patterns from captured traffic or HAR files into OpenAPI specifications and structured pattern files.

Community
Intermediate
SkobynSkobyn

hunt-graphql

Analyze GraphQL schemas to identify security vulnerabilities.

Community
Advanced
kmshihab7878kmshihab7878
6

api-testing-suite

Automate REST API testing with Bruno, Schemathesis, Hypothesis, Spectral, and Locust.

Community
Intermediate
dmbs335dmbs335
18

fuzzer-wordlist-generator

Generate fuzzing wordlists and mutation seeds from vulnerability taxonomy documents.

Community
Advanced