offensive-api-abuse

覆盖 API 滥用方法 包括 业务逻辑绕过 + GraphQL 攻击 + 分页利用

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.

请帮我安装这个 Agent Skill：https://github.com/SnailSploit/Claude-Red/tree/main/Skills/api/offensive-api-abuse

1. 先读取该目录下的 SKILL.md 和其他文件，检查是否有可疑内容（执行未知脚本、读取密钥、向外发送数据等），用中文告诉我它会做什么、需要哪些权限；
2. 等我确认后，再把整个目录安装到 ~/.claude/skills/offensive-api-abuse/（如果你不是 Claude Code，安装到你自己约定的 skills 目录）；
3. 安装后告诉我怎么触发它。

git clone --depth 1 --filter=blob:none --sparse https://github.com/SnailSploit/Claude-Red.git /tmp/offensive-api-abuse-src
cd /tmp/offensive-api-abuse-src && git sparse-checkout set "Skills/api/offensive-api-abuse"
mkdir -p ~/.claude/skills && cp -r "Skills/api/offensive-api-abuse" ~/.claude/skills/offensive-api-abuse

Skill 可以让智能体执行脚本。安装第三方 Skill 前务必看一遍内容，详见「安全」一课。