mcpField
A
api-recon-and-docs

api-recon-and-docs

github.com/yaklangSecurity2.6k3.8k installsUpdated 6w ago
Repository

About api-recon-and-docs

A reconnaissance skill for security testing REST, mobile, and GraphQL APIs. It helps identify entry points, docs, versions, and undocumented parameters, then routes findings to relevant follow-up tests.

Key features

  1. 01Discover API entry points
  2. 02Find documentation and schemas
  3. 03Identify legacy and mobile paths
  4. 04Extract optional fields and role differences
  5. 05Route findings to follow-up tests

Use cases

  1. 01Map API surfaces before testing
  2. 02Find endpoint paths in client scripts
  3. 03Inspect docs for admin endpoints and fields
  4. 04Locate legacy or undocumented APIs

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/yaklang/hack-skills --skill api-recon-and-docs

After installing, type/api-recon-and-docsin Claude Code to confirm it loaded.

Details

From the project README

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.

1. PRIMARY GOALS

  1. Discover all reachable API entrypoints.
  2. Extract schemas, optional fields, and role differences.
  3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

2. RECON CHECKLIST

JavaScript and client mining
curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u
Common documentation and schema paths
/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql
Version and product drift
/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/

3. WHAT TO EXTRACT FROM DOCS

  • optional and undocumented fields
  • admin-only request examples
  • deprecated endpoints that may still be active
  • schema hints like additionalProperties: true
  • parameter names tied to filtering, sorting, IDs, roles, or tenancy

4. NEXT ROUTING

FindingNext Skill
object IDs everywhereapi authorization and bola
JWT, OAuth, role claimsapi auth and jwt abuse
GraphQL or hidden fieldsgraphql and hidden parameters
strong auth boundary but suspicious business flowbusiness logic vulnerabilities

Comments

Markdown supported