Api Fuzzing Bug Bounty
This is a comprehensive reference for offensive API testing during bug bounties and pentests. It covers REST, SOAP, and GraphQL with concrete techniques for finding IDORs, authentication bypasses, injection points, and rate limit issues. The GraphQL section is especially dense with introspection queries, batching attacks, and schema enumeration tricks. It includes actual payloads you can adapt, like IDOR bypass techniques using array wrapping and parameter pollution, plus endpoint bypass strings for 403 responses. The checklist format makes it easy to methodically work through common API vulnerabilities. If you're hunting bugs or doing authorized security assessments, this gives you a structured workflow with ready to use examples rather than theoretical descriptions.
- GitHub stars
- 39.4K
- last updated
- Jun 3, 2026
Install
$ npx -y skills add sickn33/antigravity-awesome-skills --skill api-fuzzing-bug-bounty --agent claude-codeInstalls into .claude/skills of the current project.
Files
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
API Fuzzing for Bug Bounty
Purpose
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/sickn33/antigravity-awesome-skills
- Categories
- Backend & APIs, Debugging
- First seen
- Jun 3, 2026
More from sickn33/antigravity-awesome-skills
All 708- Broken Authentication
- Burp Suite Testing
- Cross Site Scripting And HTML Injection Testing
- File Path Traversal
- IDOR Vulnerability Testing
- Linux Production Shell Scripts
- Red Team Tools And Methodology
- Scanning Tools
- Shodan Reconnaissance And Pentesting
- SQLMap Database Penetration Testing
- Top Web Vulnerabilities
- Wireshark Analysis
- Docker Expert23.5K
- Nodejs Best Practices12.6K
- Typescript Expert10.4K
- Clean Code9.1K
- Api Security Best Practices7.9K
- Nextjs Best Practices6.7K
- Browser Automation5.8K
- Nextjs Supabase Auth5.8K
- Prisma Expert3.8K
- Playwright Skill3.5K
- 3d Web Experience3.4K
- Game Development3.3K
Recommended
More Backend & APIs
SQLMap Database Penetration Testingsickn33/antigravity-awesome-skillssqlmap database penetration testing0skills.sh installs
firebase-crashlyticsfirebase/agent-skillsComprehensive guide for Firebase Crashlytics, including provisioning and SDK usage. Use this skill when the user needs help setting up Crashlytics, adding crash138.9Kskills.sh installs
convex-setup-authget-convex/agent-skillsSets up Convex auth, identity mapping, and access control. Use for login, auth providers, users tables, protected functions, or roles in a Convex app.94Kskills.sh installs
better-auth-security-best-practicesbetter-auth/skillsConfigure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addres50.7Kskills.sh installs
golang-grpcsamber/cc-skills-golangProvides gRPC usage guidelines, protobuf organization, and production-ready patterns for Golang microservices. Use when implementing, reviewing, or debugging gR40.7Kskills.sh installs
postgresql-table-designwshobson/agentsUse this skill when designing or reviewing a PostgreSQL-specific schema. Covers best-practices, data types, indexing, constraints, performance patterns, and adv28.7Kskills.sh installs