testing-apis

Test REST and GraphQL APIs for injection, access control, and endpoint vulnerabilities.

Updated Apr 29, 2026

Search Tags:#security #vulnerability #api #rest #graphql #pentesting #fuzzing

Ready to run

npx skills add https://github.com/martiirivass/parcialGestionRobledo --skill testing-apis-martiirivass

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: testing-apis
Source: https://github.com/martiirivass/parcialGestionRobledo/tree/main/.agents/skills/testing-apis
Command: npx skills add https://github.com/martiirivass/parcialGestionRobledo --skill testing-apis-martiirivass

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security professionals and developers identify and exploit common security flaws in APIs, ensuring robust protection against unauthorized access and data breaches.

Core Features & Use Cases

API Vulnerability Testing: Detect authentication bypass, authorization flaws, and injection vulnerabilities in REST and GraphQL APIs.
Reconnaissance and Fuzzing: Discover hidden API endpoints and test parameter inputs to find potential security issues.
Use Case: A security researcher tests a new microservice for IDOR vulnerabilities by iteratively accessing different user IDs and analyzing responses.

Quick Start

Use the testing-apis skill to scan an API endpoint for injection and authorization flaws by providing the target URL and credentials.

Frequently Asked Questions about testing-apis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test REST and GraphQL APIs for security vulnerabilities?▼

To test REST and GraphQL APIs for vulnerabilities, you scan endpoints for injection, access control issues, and authentication bypass flaws by providing the target URL and credentials to initiate the analysis.

What is API fuzzing and how does it find hidden endpoints?▼

API fuzzing discovers hidden endpoints by manipulating parameter inputs and analyzing server responses to uncover undocumented routes and potential security issues within the target architecture.

Can I use this approach to detect IDOR vulnerabilities in microservices?▼

Yes, you can detect IDOR vulnerabilities in microservices by iteratively accessing different user IDs and analyzing API responses to identify broken access control and authorization flaws.

What is the best way to analyze API documentation for security flaws?▼

The best way to analyze API documentation for security flaws is to perform documentation analysis alongside parameter manipulation to identify inconsistencies and ensure overall API security integrity.

Does this method test for both authentication bypass and authorization flaws?▼

Yes, this method tests for both authentication bypass and authorization flaws by comprehensively evaluating REST and GraphQL endpoints against unauthorized access and data breach scenarios.