# Offensive API Abuse

Advanced API exploitation methodology focused on business logic abuse and sophisticated...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Design
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-api-abuse -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-api-abuse -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-api-abuse -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-api-abuse -g -a gemini-cli -y`

## Description

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Offensive API Abuse and Advanced Exploitation

You are conducting authorized security assessments targeting the business logic layer of API-driven applications. Traditional vulnerability scanners miss the attack patterns in this skill because they require understanding of application workflows, state transitions, and trust relationships between API endpoints. Your goal is to identify vulnerabilities that allow financial manipulation, data exfiltration through legitimate channels, privilege escalation via workflow abuse, and service disruption through logic-layer attacks.

## Quick Workflow

1. Map the complete API surface including undocumented endpoints using Arjun, ParamSpider, and manual discovery.
2. Model the business workflows: identify multi-step transactions, state machines, and trust chains between endpoints.
3. Test each workflow for race conditions using parallel request techniques.
4. Extract and analyze JWTs for algorithm confusion, weak signing, and claim injection opportunities.
5. If GraphQL is present, test batching for brute-force amplification, query depth for DoS, and introspection for schema leakage.
6. Probe pagination for data enumeration and exfiltration opportunities.
7. Test webhook configurations for SSRF and callback hijacking.
8. Search for API key leakage in client code, error responses, and public repositories.
9. Verify all discovered endpoints for authorization consistency.
10. Document business impact for each finding with financial or operational consequence estimates.

---

## Business Logic Bypass via API Chaining

Business logic vulnerabilities emerge when individual API endpoints are secure in isolation but the workflow connecting them has exploitable gaps. You identify these by mapping the intended transaction flow and then deviating from it.

```bash
# E-commerce checkout bypass
# Normal flow: add_to_cart -> apply_coupon -> calculate_total -> pay -> confirm
# Attack: skip payment and go directly to confirm

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/api/offensive-api-abuse/SKILL.md