What problem does it solve? APIs frequently ship with misconfigurations—mass assignment, weak JWT validation, permissive CORS, exposed Swagger specs, and OData query-layer bypasses—that traditional SQLi-focused WAFs and scanners miss. This Skill gives security testers concrete payloads, detection heuristics, and real disclosed cases to find these flaws during authorized assessments. ## Core Features & Use Cases - Mass Assignment & JWT Attacks: Test profile/account endpoints with privileged fields (is_admin, role, verified) and attack JWTs via alg=none, RS256-to-HS256 confusion, weak HMAC bruteforce, kid path traversal, and JWK injection. - OData & WAF Bypass Techniques: Exploit $filter/$orderby/$batch parsing discrepancies, encoded operators, and $expand navigation-property IDOR against SharePoint, Dynamics 365, SAP, and ASP.NET OData services. - Swagger/OpenAPI Spec Exploitation: Discover exposed /swagger and /openapi.json endpoints, extract hidden routes and schemas for IDOR and mass-assignment payload construction, and test configUrl takeover. - Use Case: During a bug bounty engagement against an ASP.NET Core API, probe /swagger/v1/swagger.json, extract the UserUpdateDto schema, then PATCH /users/me with role=admin to demonstrate privilege escalation. ## Quick Start Ask the AI to test a target API endpoint for mass assignment, JWT algorithm confusion, CORS misconfiguration, and exposed Swagger documentation using this skill.
