メニュー
Use this skill when web or API dynamic testing needs stateful request fuzzing, schema-backed fuzzing, parameter fuzzing, captured HTTP replay, or logic-oracle evidence.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
Use this skill when MaxTAC Source should use the plugin-bundled codebase-memory-mcp MCP integration or CLI fallback for repository indexing, architecture overview, structural search, call-path tracing, diff impact mapping, ADR lookup, or code graph evidence before SAST triage, CFG work, OpenGrep authoring, or source scans.
Use this skill when MaxTAC Android needs a loop that models an Android app's user-facing resources and systematically walks activities, deep links, forms, WebViews, share targets, notifications, and other user-facing inputs for security auditing while respecting scope and safety constraints.
Use this skill when Apple Systems research needs a loop over IPSW or OTA firmware diffs, Apple security advisories, CVEs, build provenance, and binary/source patch archaeology to identify patched Apple components, infer why they changed, and enrich an ASB threat model.
Use this skill when MaxTAC Binary needs a loop to model how a binary was compiled and loaded, preserve reverse-engineering provenance, prioritize executable functions by reachability or call frequency, systematically decompile or parse functions and data structures, and produce durable functionality and security evidence.
Use this skill when MaxTAC research needs a durable security model, invariant dictionary, invariant receipts with proof obligations and refutation conditions, architecture understanding, first-order-logic-style assertions, unknown tracking, contradiction tracking, or model-backed auditor handoffs across source, web, cloud, binary, supply-chain, Android, Apple, or Microsoft targets.
Use this skill when MaxTAC research needs goal-bounded auditor subagents, verifier debate subagents, specialist bug-class review, mitigation review, or independent votes on a vulnerability hypothesis or PoV.
SOC 職業分類に基づく
| name | maxtac-web-api-fuzzing |
| description | Use this skill when web or API dynamic testing needs stateful request fuzzing, schema-backed fuzzing, parameter fuzzing, captured HTTP replay, or logic-oracle evidence. |
Use this skill for REST, GraphQL, HTTP, webhook, browser-request, and SaaS workflow fuzzing. Web/API fuzzing is mostly an oracle and state-model problem: the request sequence must preserve authentication, object creation, cleanup, tenant context, and the security invariant under test.
Use python3 <skill-dir>/scripts/fuzz-campaign.py to create and lint web fuzzing evidence bundles under <workspace-root>/fuzz/<campaign-id>/.
Initialize a campaign:
python3 <skill-dir>/scripts/fuzz-campaign.py init \
--target "billing GraphQL mutation" \
--target-version "2026-06-28 deploy" \
--tool Schemathesis \
--version-command "schemathesis --version" \
--scope "authorized staging tenant" \
--environment "local or approved test deployment" \
--rate-limits "10 rps, test account only" \
--instrumentation "schema + invariant oracle" \
--command "schemathesis run openapi.yaml --checks all" \
--schema ./openapi.yaml
Attach an API or logic result:
python3 <skill-dir>/scripts/fuzz-campaign.py add-run <campaign-id> \
--kind api \
--api-request-sequence ./replay.har \
--auth-context "test user in tenant A" \
--resource-id "invoice_123" \
--cleanup-action "delete invoice_123"
Before handoff, run:
python3 <skill-dir>/scripts/fuzz-campaign.py lint <campaign-id> --kind api --strict
python3 <skill-dir>/scripts/fuzz-campaign.py summary <campaign-id>
Read <skill-dir>/references/web-api-fuzzing.md for RESTler, Schemathesis, Nuclei, Burp Intruder, ZAP Fuzzer, ffuf, and replay guidance.
Prefer stateful schema or model-based fuzzing when request order matters. Use captured-traffic or parameter fuzzing only when a lower-level model is unavailable or the target workflow is mostly request-shape variation.
Preserve the API spec, GraphQL schema, HAR/curl replay, auth context, tenant and resource IDs, cleanup actions, response bodies, relevant server logs, and the invariant being tested. Do not treat response-code differences as vulnerabilities unless they demonstrate authorization, isolation, disclosure, state corruption, or another security boundary crossing.