fuzzing▌

api-fuzzing-bug-bounty

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

### offensive-fuzzing - Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-fuzzing-course - - **Skill Name**: fuzzing-course - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-vuln-classes - - **Skill Name**: vulnerability-classes - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-bug-identification - - **Skill Name**: bug-identification - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and find security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication bypasses, resource leaks, and payload injection vulnerabilities. Activates for requests involving API fuzzing, RESTler testing, stateful API testing, or automated API security scanning.

Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.

Domain-specific token guidance for fuzzers targeting parsers, protocols, and file formats. \n \n Provides dictionary file format with quoted strings, hex escapes, and key-value pairs that guide fuzzer mutations toward meaningful inputs and deeper code paths \n Works cross-fuzzer with libFuzzer, AFL++, and cargo-fuzz via standard command-line flags ( -dict= , -x ) \n Includes generation methods: LLM prompts, extraction from headers and binaries, and AFL++ auto-dictionary via compile-time string c