unauth-api-flow-hijack

What problem does it solve?

Unauthenticated multi-step API workflows (such as job applications, checkout processes, and onboarding flows) often expose core business logic without requiring any credentials, allowing attackers to manipulate workflows, upload malicious files, and exfiltrate sensitive data without authorization.

Core Features & Use Cases

• Full Workflow Mapping & Exploitation: Automatically map and complete entire multi-step API flows (start → intermediate steps → completion) without authentication, leveraging returned session identifiers to progress through steps.
• File Upload Abuse Testing: Test for unrestricted file upload vulnerabilities in unauthenticated flows and extract public storage URLs for uploaded files.
• Sensitive Data Export: Exploit export functionality in completed flows to download bulk sensitive data (applicant records, transaction data, etc.) without credentials.
• Use Case: A public job application API that requires no login lets you submit fake applications, upload malicious resumes, and export all applicant personal and professional data in bulk.

Quick Start

Use the unauth-api-flow-hijack skill to map and exploit the full unauthenticated multi-step API workflow at https://target.com, including file upload and data export steps.