Skill UI

Provides step-by-step API fuzzing and exploitation tactics for REST, SOAP, and GraphQL during bug bounty or penetration tests, covering reconnaissance, auth bypass, IDOR, injection, and GraphQL-specific attacks.

Guides bug bounty hunters through API fuzzing and penetration testing, covering REST, SOAP, and GraphQL recon, authentication bypass, IDOR methods, injections, method abuse, GraphQL attacks, and payload delivery techniques.

Provides production-ready patterns for integrating with the Guidewire insurance platform. This SDK abstracts the complexity of hybrid APIs (REST/SOAP), offering a structured client, robust error handling (retry logic, conflict detection), and a fluent query builder for consistent data access across policies and claims.

Guides bug bounty hunters through REST, SOAP, and GraphQL API fuzzing to uncover authentication weaknesses, IDOR, injections, and endpoint bypasses while outlining practical reconnaissance and exploitation workflows.

Access the BRENDA SOAP API to retrieve enzyme kinetic parameters, reaction equations, organism-specific data, and environmental preferences, enabling biochemical research, metabolic pathway reconstruction, and enzyme engineering workflows.

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

A comprehensive, 10-phase methodology for authorized security assessment of modern APIs, including REST, GraphQL, WebSocket, and SOAP. This guide covers the entire testing lifecycle—from endpoint discovery and authentication bypass (JWT/OAuth 2.0) to sophisticated authorization flaws (BOLA/IDOR/BFLA), input validation, rate limiting, and CI/CD integration testing.

Provides techniques for testing REST, SOAP, and GraphQL APIs during authorized bug bounty and penetration testing, covering endpoint discovery, auth bypass, IDOR, injection, and API-specific attack vectors.

This skill provides a structured methodology for authorized security assessments of REST, GraphQL, WebSocket, and SOAP APIs. It covers discovery, authentication flaws (JWT/OAuth), authorization issues (BOLA/IDOR), rate-limit testing, and CI/CD integration. Includes 10-phase workflow from reconnaissance to reporting, utilizing tools like Entropy, Burp, and FireTail for comprehensive vulnerability identification.

Authorized-use hunting guide for XXE vulnerabilities: maps XML entry points, tests file uploads, SAML and SOAP endpoints, then escalates from inline file read to blind out-of-band exfiltration, SSRF pivoting and internal service access.