api▌

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

Build modular Flask REST APIs with blueprints, SQLAlchemy ORM, JWT authentication, and validation. \n \n Covers application setup, database models, JWT authentication, blueprints for modular design, request validation, and configuration management \n Includes error handling middleware, CORS support, request ID tracking, and proper HTTP status code responses \n Emphasizes input validation, environment-based configuration, and comprehensive logging for production readiness \n Provides reference gu

Search 78 public scientific, biomedical, materials science, and economic databases via REST APIs.

ASP.NET Minimal API endpoints with automatic OpenAPI/Swagger documentation and strong typing. \n \n Organize endpoints using MapGroup() , endpoint filters, and feature-based folder structures for scalability \n Define explicit request/response DTOs with validation attributes; use record types and TypedResults for type safety \n Leverage .NET 9 built-in OpenAPI support with operation summaries, descriptions, operationIds, and property-level documentation via [Description()] \n Apply document and

HTTP API access to CloudBase platform features including database, authentication, functions, storage, and hosting. \n \n Supports MySQL RESTful API for CRUD operations on database tables via GET, POST, PATCH, DELETE endpoints with field selection, filtering, pagination, and sorting \n Requires authentication via AccessToken (user permissions), API Key (admin permissions), or Publishable Key (anonymous access); tokens passed in Authorization header \n Provides unified domain endpoints for domest

### offensive-api-abuse - Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security con - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-api-security - Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.

Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.