skills.rest
martiirivass
martiirivassCOMMUNITY
Explore all skills by this author →
GitHub

testing-apis

Test REST and GraphQL APIs for injection, access control, and endpoint vulnerabilities.

Updated Apr 29, 2026
Search Tags:#security#vulnerability#api#rest#graphql#pentesting#fuzzing
One-click install
npx skills add https://github.com/martiirivass/parcialGestionRobledo --skill testing-apis-martiirivass
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-apis
Source: https://github.com/martiirivass/parcialGestionRobledo/tree/main/.agents/skills/testing-apis
Command: npx skills add https://github.com/martiirivass/parcialGestionRobledo --skill testing-apis-martiirivass

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security professionals and developers identify and exploit common security flaws in APIs, ensuring robust protection against unauthorized access and data breaches.

Core Features & Use Cases

  • API Vulnerability Testing: Detect authentication bypass, authorization flaws, and injection vulnerabilities in REST and GraphQL APIs.
  • Reconnaissance and Fuzzing: Discover hidden API endpoints and test parameter inputs to find potential security issues.
  • Use Case: A security researcher tests a new microservice for IDOR vulnerabilities by iteratively accessing different user IDs and analyzing responses.

Quick Start

Use the testing-apis skill to scan an API endpoint for injection and authorization flaws by providing the target URL and credentials.

Frequently Asked Questions about testing-apis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test REST and GraphQL APIs for security vulnerabilities?▼

To test REST and GraphQL APIs for vulnerabilities, you scan endpoints for injection, access control issues, and authentication bypass flaws by providing the target URL and credentials to initiate the analysis.

What is API fuzzing and how does it find hidden endpoints?▼

API fuzzing discovers hidden endpoints by manipulating parameter inputs and analyzing server responses to uncover undocumented routes and potential security issues within the target architecture.

Can I use this approach to detect IDOR vulnerabilities in microservices?▼

Yes, you can detect IDOR vulnerabilities in microservices by iteratively accessing different user IDs and analyzing API responses to identify broken access control and authorization flaws.

What is the best way to analyze API documentation for security flaws?▼

The best way to analyze API documentation for security flaws is to perform documentation analysis alongside parameter manipulation to identify inconsistencies and ensure overall API security integrity.

Does this method test for both authentication bypass and authorization flaws?▼

Yes, this method tests for both authentication bypass and authorization flaws by comprehensively evaluating REST and GraphQL endpoints against unauthorized access and data breach scenarios.

Related Skills

Explore More Software Engineering Skills→
Wania-KazmiWania-Kazmi
5

api-patterns

Standardize REST and GraphQL API design with consistent routes, authentication, and error handling.

Community
Intermediate
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate
EntroVyxEntroVyx
3

recon-fire-restoration

Automate security reconnaissance of WordPress restoration sites to detect PII leaks and misconfigurations.

Community
Intermediate
TimHL5TimHL5

canary

Monitor post-deploy web apps for console errors, performance metrics, and page failures.

Community
Advanced