hunt-schema-enumeration
Installation
SKILL.md
When to Use
The target API returns structured error messages (JSON) that hint at valid table names, field names, or endpoint paths. This is the single most productive black-box recon technique for REST/GraphQL APIs — one fuzz request reveals the entire database schema.
Most common on: PostgREST (Supabase), FastAPI (.NET), Zod (Next.js/Node), tRPC, GraphQL, and any framework with validation error details enabled in production.
Phase 1 — PostgREST Error Hint Enumeration
PostgREST is the REST API layer for Supabase/PostgreSQL. When you query a non-existent table, it returns a hint with the real table name.
SUPABASE_URL="https://PROJECT.supabase.co"
ANON_KEY="eyJ..."