api-recon-and-docs
yaklang/hack-skills
Discover API endpoints, schemas, versions, and hidden documentation surface before testing.
What is api-recon-and-docs?
API reconnaissance and documentation review playbook for discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area. Use this first when targeting REST, mobile, or GraphQL APIs to enumerate all reachable entrypoints and extract schema details before exploitation.
- Discover all reachable API entrypoints and endpoints
- Extract schemas, optional fields, and role-based differences
- Identify old API versions, mobile paths, GraphQL endpoints, and undocumented parameters
- Mine JavaScript and client code for hidden API paths
- Locate common documentation paths (Swagger, OpenAPI, API docs)
- Extract parameter names tied to filtering, sorting, IDs, roles, or tenancy
How to install api-recon-and-docs
npx skills add https://github.com/yaklang/hack-skills --skill api-recon-and-docsHow to use api-recon-and-docs
- 1.Run JavaScript mining to extract API paths from client code using grep patterns
- 2.Check common documentation paths like /swagger.json, /openapi.json, /api-docs
- 3.Test for version endpoints (/api/v1/, /api/v2/, /api/mobile/v1/, /legacy/)
- 4.Extract schema details from documentation including optional fields and role differences
- 5.Identify deprecated endpoints that may still be active
- 6.Document all discovered endpoints and their parameters for next testing phase
Use cases
- Enumerate REST API endpoints before testing for authorization flaws
- Discover GraphQL endpoints and schema details for hidden field exploitation
- Find deprecated API versions that may still be active and vulnerable
- Extract mobile API paths and version differences from client code
- Locate OpenAPI/Swagger documentation to understand request/response schemas
- Security researchers testing REST APIs
- Penetration testers targeting mobile or web APIs
- API security auditors mapping API surface area
- Red teamers discovering hidden API endpoints
api-recon-and-docs FAQ
Route to api-authorization-and-bola if you find object IDs, api-auth-and-jwt-abuse for JWT/OAuth findings, graphql-and-hidden-parameters for GraphQL endpoints, or business-logic-vulnerabilities if auth is strong but business logic seems suspicious.
Check common paths like /swagger.json, /openapi.json, /api-docs, /docs, /.well-known/, and mine JavaScript files for endpoint patterns using grep on /api, /rest, and /graphql paths.
Test /api/v1/, /api/v2/, /api/mobile/v1/, and /legacy/ paths as older versions may have weaker security or deprecated endpoints still active.
Focus on optional and undocumented fields, admin-only examples, deprecated endpoints, additionalProperties settings, and parameter names related to filtering, sorting, IDs, roles, or tenancy.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: api-recon-and-docs description: >- API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.
SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface
AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.
1. PRIMARY GOALS
- Discover all reachable API entrypoints.
- Extract schemas, optional fields, and role differences.
- Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.
2. RECON CHECKLIST
JavaScript and client mining
curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u
Common documentation and schema paths
/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql
Version and product drift
/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/
3. WHAT TO EXTRACT FROM DOCS
- optional and undocumented fields
- admin-only request examples
- deprecated endpoints that may still be active
- schema hints like
additionalProperties: true - parameter names tied to filtering, sorting, IDs, roles, or tenancy
4. NEXT ROUTING
| Finding | Next Skill |
|---|---|
| object IDs everywhere | api authorization and bola |
| JWT, OAuth, role claims | api auth and jwt abuse |
| GraphQL or hidden fields | graphql and hidden parameters |
| strong auth boundary but suspicious business flow | business logic vulnerabilities |
Related skills
More from yaklang/hack-skills and the wider catalog.
api-sec
Entry point router for API security testing—choose between recon, authorization, token abuse, and GraphQL workflows.
arbitrary-write-to-rce
Convert arbitrary write primitives into code execution by targeting GOT, hooks, _IO_FILE, exit_funcs, TLS_dtor_list, and other glibc structures.
auth-sec
Entry point router for authentication, authorization, sessions, and identity protocol testing.
authbypass-authentication-flaws
Authentication bypass testing playbook for login flows, password reset, MFA, and token flaws.
binary-protection-bypass
Identify and bypass ASLR, PIE, NX, canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries.
browser-exploitation-v8
V8 and Chrome browser exploitation: JIT type confusion, sandbox bypass, and renderer RCE techniques.