API Fuzzing for Bug Bounty
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONOBFUSCATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references multiple third-party security tools and wordlists hosted on GitHub, Netlify, and GitHub Pages, such as Kiterunner, SecLists, and InQL.
- [COMMAND_EXECUTION]: Provides example payloads for testing command injection vulnerabilities on remote API targets (e.g., using linux command separators like ;ls or Ruby Kernel calls).
- [DATA_EXFILTRATION]: Documents the use of external services like iplogger.com to identify IP disclosure vulnerabilities during PDF export testing.
- [OBFUSCATION]: Includes URL-encoded characters (e.g., %20, %09, %C/script%E) used in testing for 403 bypasses and cross-site scripting (XSS).
- [DATA_EXPOSURE]: References sensitive system file paths like /etc/passwd in payloads intended for testing Local File Inclusion (LFI) and XML External Entity (XXE) vulnerabilities.
Audit Metadata