purpleailab Modern API Attack Category
This is a routing skill. Identify the API protocol then load the matching sub-skill.
Sub-skills
| Protocol | Sub-skill | Wire signature |
|---|---|---|
| gRPC | grpc |
HTTP/2 + `application/grpc[+proto |
| SOAP/WSDL | soap-wsdl |
XML body in text/xml/application/soap+xml, ?wsdl discovery |
| WebSocket | websocket |
HTTP Upgrade: websocket handshake, then framed binary/text |
| Server-Sent Events | server-sent-events |
Content-Type: text/event-stream, one-way streaming |
Quick fingerprint
# gRPC?
curl -sk -I --http2 https://target/svc | grep -i 'application/grpc'
# SOAP?
curl -sk "https://target/endpoint?wsdl" | head -1 # XML WSDL doc
curl -sk -X POST -H 'Content-Type: text/xml' https://target/endpoint # 500 with SOAP fault
# WebSocket?
curl -sk -I -H "Connection: Upgrade" -H "Upgrade: websocket" https://target/ws | head -1
# 101 = WS upgrade
# SSE?
curl -sk -i https://target/stream -H "Accept: text/event-stream" | grep 'text/event-stream'
Sibling skills
For REST + GraphQL go to:
load_skill("/skills/standard/exploit/web/SKILL.md")— sub-skillsgraphql,idor,mass-assignment, etc.