Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-shadow-api
Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation o
Passed 18 of 22 test cases with the skill, and 16 of 22 without it.
2 fixed16 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
The `/api/v2/search` endpoint sanitizes SQL characters and rejects single quotes, but `/api/v1/search` accepts unescaped SQL syntax without validation. How should this finding be classified and escalated?
| Checked | Without skill | With skill |
|---|---|---|
| Classify forward-only input validation hardening as High severity | Missed | Passed |
| Chain forward-only validation regressions into underlying injection workflows | Passed | Passed |
The instructions your model reads when the skill loads.
As an API evolves, old versions and internal/staging routes routinely stay reachable without receiving the same security fixes as the current version — because nobody tracks that they still exist. The bug is rarely in one endpoint; it's in the delta between what an old version enforces and what the current version enforces on the same operation.
Trigger when:
/v1/, /v2/, /api/2023-01-01/) or Accept/X-API-Version
headers are in play.apk-redteam-pipeline / ios-redteam-pipeline) hardcodes endpoints
that look like an older backend version than the current web app calls.info.version in one spec implies others
exist.DO NOT use for single-version APIs with no version history — there's nothing to diff; go
straight to hunt-api-misconfig for direct exploitation of the one surface that exists.
# Path-based versioning
for v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do
curl -s -o /dev/null -w "%{http_code} /api/$v/\n" "https://$TARGET/api/$v/"
done
# Header-based versioning
curl -s -H "X-API-Version: 1" https://$TARGET/api/users
curl -s -H "Accept: application/vnd.company.v1+json" https://$TARGET/api/users
# Subdomain-based versioning
for sub in api api-v1 api-v2 apiv1 apiv2 legacy-api old-api internal-api staging-api; do
curl -s -o /dev/null -w "%{http_code} $sub\n" "https://$sub.$TARGET/"
done
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.