Тестирование безопасности API для баг-бунти

★ 6.6 · security

api-fuzzing-bug-bounty is a Claude Code skill that provides a structured methodology for security testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. The workflow spans five stages: endpoint reconnaissance using Swagger/OpenAPI paths and Kiterunner, authentication testing with rate-limit checks across mobile and web APIs, IDOR exploitation with bypass techniques such as JSON wrapping, parameter pollution, and wildcard injection, injection testing covering SQL, XXE, SSRF, and command injection vectors, and HTTP method enumeration with content-type switching. GraphQL-specific coverage includes introspection queries, mutation batching to bypass rate limits, nested-query DoS patterns, and tools like GraphCrawler, InQL, and GraphQLmap. The skill is aimed at security researchers and penetration testers who need comprehensive, API-specific attack coverage in one place.