How do I install the API Fuzzing skill?

Run npx skillmds@latest add noorqureshi/api-fuzzing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Fuzzing safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Fuzzing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Fuzzing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Fuzzing?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Fuzzing by noorqureshi — Agent Skill

Name: API Fuzzing
Author: NoorQureshi

API Fuzzing

Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec, or "map/fuzz the API". Signals: /api, /v1, swagger.json, GraphQL, mobile backend, undocumented routes.

NoorQureshi ff0db32 2.0 KB Updated Sep 17, 2026

File contents

API discovery & fuzzing

When it applies

You need the API's real surface before attacking it: hidden endpoints, accepted methods, extra params, and old versions. Complete inventory is where BOLA/mass-assignment/auth bugs surface.

Why it works

APIs expose far more than the client uses; specs, JS, and mobile apps reveal routes, and version drift leaves un-patched endpoints. Enumerating the surface turns guesswork into targeted testing.

Method

Harvest from specs/clients: OpenAPI/Swagger (swagger.json, /api-docs), Postman collections, GraphQL introspection, and endpoints in JS bundles / mobile apps.
Route brute: kiterunner (API-aware wordlists incl. methods) or ffuf against /api/FUZZ, /v{1,2,3}/; try each with GET/POST/PUT/PATCH/DELETE — method matters.
Param discovery: arjun/Burp param miner per endpoint to find hidden inputs (feed mass-assignment, injection, IDOR tests).
Version & shadow: enumerate /v1../v3, /internal, /beta; compare behaviour/auth across versions.
Feed the results into api-bola, api-mass-assignment, api-auth-attacks, injection.

Gotchas

Respect rate limits and scope — API fuzzing is noisy; throttle and stay on in-scope hosts.
A route that 401s still counts — note it for auth testing; 404 vs 401 vs 403 map the surface.
Method-fuzzing finds actions the client never issues (hidden admin verbs).

Verify success

A materially larger, documented endpoint/param inventory (with methods/versions) ready for vuln-class testing — including routes not in the official docs.

References

OWASP API Security (API9); kiterunner; PortSwigger API testing guide.

---name: api-fuzzingdescription: Discover and fuzz API endpoints, methods, params, and versions systematically. Load when you have an API base but not its full surface, an OpenAPI/Swagger/Postman spec, or "map/fuzz the API". Signals: /api, /v1, swagger.json, GraphQL, mobile backend, undocumented routes.---# API discovery & fuzzing## When it appliesYou need the API's real surface before attacking it: hidden endpoints, accepted methods, extraparams, and old versions. Complete inventory is where BOLA/mass-assignment/auth bugs surface.## Why it worksAPIs expose far more than the client uses; specs, JS, and mobile apps reveal routes, andversion drift leaves un-patched endpoints. Enumerating the surface turns guesswork into targeted testing.## Method1. **Harvest from specs/clients**: OpenAPI/Swagger (`swagger.json`, `/api-docs`), Postman collections, GraphQL introspection, and endpoints in JS bundles / mobile apps.2. **Route brute**: `kiterunner` (API-aware wordlists incl. methods) or `ffuf` against `/api/FUZZ`, `/v{1,2,3}/`; try each with GET/POST/PUT/PATCH/DELETE — method matters.3. **Param discovery**: `arjun`/Burp param miner per endpoint to find hidden inputs (feed mass-assignment, injection, IDOR tests).4. **Version & shadow**: enumerate `/v1../v3`, `/internal`, `/beta`; compare behaviour/auth across versions.5. **Feed the results** into `api-bola`, `api-mass-assignment`, `api-auth-attacks`, injection.## Gotchas- Respect rate limits and scope — API fuzzing is noisy; throttle and stay on in-scope hosts.- A route that 401s still counts — note it for auth testing; 404 vs 401 vs 403 map the surface.- Method-fuzzing finds actions the client never issues (hidden admin verbs).## Verify successA materially larger, documented endpoint/param inventory (with methods/versions) ready forvuln-class testing — including routes not in the official docs.## ReferencesOWASP API Security (API9); kiterunner; PortSwigger API testing guide.

Frequently asked questions