ineedcodes 1.6.1 → 1.7.0

package/skills/anti-debugging-techniques/SKILL.md

@@ -0,0 +1,407 @@
+---
+name: anti-debugging-techniques
+description: >-
+  Anti-debugging detection and bypass playbook. Use when reversing protected
+  binaries that detect debuggers via ptrace, PEB flags, timing checks, or
+  signal/exception handlers on Linux and Windows.gated: true
+---
+
+# SKILL: Anti-Debugging Techniques — Detection & Bypass Playbook
+
+> **AI LOAD INSTRUCTION**: Expert anti-debug techniques across Linux and Windows. Covers ptrace, PEB flags, NtQueryInformationProcess, timing attacks, signal-based detection, TLS callbacks, VEH tricks, and all corresponding bypass methods. Base models often miss the distinction between user-mode and kernel-mode detection and the correct patching strategy for each.
+
+## 0. RELATED ROUTING
+
+- [code-obfuscation-deobfuscation](../code-obfuscation-deobfuscation/SKILL.md) when the binary also uses control flow flattening, VM protection, or string encryption
+- [vm-and-bytecode-reverse](../vm-and-bytecode-reverse/SKILL.md) when the anti-debug sits inside a custom VM dispatcher
+- [symbolic-execution-tools](../symbolic-execution-tools/SKILL.md) when you want to symbolically skip anti-debug checks entirely
+
+### Advanced Reference
+
+Also load [ANTI_DEBUG_MATRIX.md](./ANTI_DEBUG_MATRIX.md) when you need:
+- Complete cross-reference matrix of technique × OS × detection method × bypass method
+- Per-technique reliability ratings and false-positive notes
+- Tool compatibility chart (GDB, x64dbg, WinDbg, Frida, ScyllaHide)
+
+### Quick bypass picks
+
+| Detection Class | First Bypass | Backup |
+|---|---|---|
+| ptrace-based (Linux) | `LD_PRELOAD` hook `ptrace()` → return 0 | Kernel module to hide tracer |
+| PEB.BeingDebugged (Windows) | Patch PEB byte at `fs:[0x30]+0x2` | ScyllaHide auto-patch |
+| Timing check (rdtsc) | Conditional BP after rdtsc, fix registers | Frida hook `rdtsc` return |
+| IsDebuggerPresent | NOP the call / hook return 0 | x64dbg built-in hide |
+| INT 2D / UD2 exception | Set VEH to handle gracefully | TitanHide driver |
+
+---
+
+## 1. LINUX ANTI-DEBUG TECHNIQUES
+
+### 1.1 ptrace(PTRACE_TRACEME)
+
+The classic self-attach: a process calls `ptrace(PTRACE_TRACEME, 0, 0, 0)`. If a debugger is already attached, the call fails (returns -1).
+
+```c
+if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) {
+    exit(1); // debugger detected
+}
+```
+
+**Bypass methods**:
+
+| Method | How |
+|---|---|
+| `LD_PRELOAD` shim | Compile shared lib: `long ptrace(int r, ...) { return 0; }` and set `LD_PRELOAD` |
+| Binary patch | NOP the `ptrace` call or patch return value check |
+| GDB catch | `catch syscall ptrace` → modify `$rax` to 0 on return |
+| Kernel module | Hook `sys_ptrace` to allow multiple tracers |
+
+### 1.2 /proc/self/status — TracerPid
+
+```c
+FILE *f = fopen("/proc/self/status", "r");
+// parse TracerPid: if non-zero → debugger attached
+```
+
+**Bypass**: Mount a FUSE filesystem over `/proc/self`, or `LD_PRELOAD` hook `fopen`/`fread` to filter `TracerPid` to 0.
+
+### 1.3 Timing Checks (rdtsc / clock_gettime)
+
+Measures elapsed time between two points; debugger single-stepping causes noticeable delay.
+
+```asm
+rdtsc
+mov ebx, eax       ; save low 32 bits
+; ... protected code ...
+rdtsc
+sub eax, ebx
+cmp eax, 0x1000    ; threshold
+ja  debugger_detected
+```
+
+**Bypass**: Set hardware breakpoint after second `rdtsc`, modify `eax` to pass the comparison. Or use Frida to replace the timing function.
+
+### 1.4 Signal-Based Detection (SIGTRAP)
+
+```c
+volatile int caught = 0;
+void handler(int sig) { caught = 1; }
+signal(SIGTRAP, handler);
+raise(SIGTRAP);
+if (!caught) exit(1); // debugger swallowed the signal
+```
+
+When a debugger is attached, `SIGTRAP` is consumed by the debugger rather than delivered to the handler. **Bypass**: In GDB, use `handle SIGTRAP nostop pass` to forward the signal.
+
+### 1.5 /proc/self/maps & LD_PRELOAD Detection
+
+Checks for injected libraries or memory regions characteristic of debuggers/instrumentation.
+
+```c
+FILE *f = fopen("/proc/self/maps", "r");
+while (fgets(buf, sizeof(buf), f)) {
+    if (strstr(buf, "frida") || strstr(buf, "LD_PRELOAD"))
+        exit(1);
+}
+```
+
+**Bypass**: Hook `fopen("/proc/self/maps")` to return a filtered version, or rename Frida's agent library.
+
+### 1.6 Environment Variable Checks
+
+Some protections check for `LD_PRELOAD`, `LINES`, `COLUMNS` (set by GDB's terminal), or debugger-specific env vars.
+
+**Bypass**: Unset suspicious env vars before launch, or hook `getenv()`.
+
+---
+
+## 2. WINDOWS ANTI-DEBUG TECHNIQUES
+
+### 2.1 IsDebuggerPresent / CheckRemoteDebuggerPresent
+
+```c
+if (IsDebuggerPresent()) ExitProcess(1);
+
+BOOL debugged = FALSE;
+CheckRemoteDebuggerPresent(GetCurrentProcess(), &debugged);
+if (debugged) ExitProcess(1);
+```
+
+**Bypass**: Hook `kernel32!IsDebuggerPresent` to return 0, or patch PEB directly.
+
+### 2.2 PEB Flags
+
+| Field | Offset (x64) | Debugged Value | Normal Value |
+|---|---|---|---|
+| `BeingDebugged` | `PEB+0x02` | 1 | 0 |
+| `NtGlobalFlag` | `PEB+0xBC` | `0x70` (FLG_HEAP_*) | 0 |
+| `ProcessHeap.Flags` | Heap+0x40 | `0x40000062` | `0x00000002` |
+| `ProcessHeap.ForceFlags` | Heap+0x44 | `0x40000060` | 0 |
+
+```asm
+mov rax, gs:[0x60]    ; PEB
+movzx eax, byte [rax+0x02]  ; BeingDebugged
+test eax, eax
+jnz debugger_detected
+```
+
+**Bypass**: Zero all four fields. ScyllaHide does this automatically.
+
+### 2.3 NtQueryInformationProcess
+
+| InfoClass | Value | Debugged Return |
+|---|---|---|
+| `ProcessDebugPort` | 0x07 | Non-zero port |
+| `ProcessDebugObjectHandle` | 0x1E | Valid handle |
+| `ProcessDebugFlags` | 0x1F | 0 (inverted!) |
+
+**Bypass**: Hook `ntdll!NtQueryInformationProcess` to return clean values per info class.
+
+### 2.4 Hardware Breakpoint Detection
+
+```c
+CONTEXT ctx;
+ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
+GetThreadContext(GetCurrentThread(), &ctx);
+if (ctx.Dr0 || ctx.Dr1 || ctx.Dr2 || ctx.Dr3)
+    ExitProcess(1);
+```
+
+**Bypass**: Hook `GetThreadContext` to zero DR0–DR3, or use `NtSetInformationThread(ThreadHideFromDebugger)` preemptively (ironically, the anti-debug technique itself).
+
+### 2.5 INT 2D / INT 3 / UD2 Exception Tricks
+
+`INT 2D` is the kernel debug service interrupt. Without a debugger, it raises `STATUS_BREAKPOINT`; with a debugger, behavior differs (byte skipping).
+
+```asm
+xor eax, eax
+int 2dh
+nop          ; debugger may skip this byte
+; ... divergent execution path ...
+```
+
+**Bypass**: Handle in VEH or patch the interrupt instruction.
+
+### 2.6 TLS Callbacks
+
+TLS callbacks execute before `main()` / `WinMain()`. Anti-debug checks placed here run before the debugger's initial break.
+
+**Bypass**: In x64dbg, set "Break on TLS Callbacks" option. In WinDbg, use `sxe ld` to break on module load.
+
+### 2.7 NtSetInformationThread(ThreadHideFromDebugger)
+
+```c
+NtSetInformationThread(GetCurrentThread(), ThreadHideFromDebugger, NULL, 0);
+```
+
+After this call, the thread becomes invisible to the debugger — breakpoints and single-stepping stop working silently.
+
+**Bypass**: Hook `NtSetInformationThread` to NOP when `ThreadInfoClass == 0x11`.
+
+### 2.8 VEH-Based Detection
+
+Registers a Vectored Exception Handler that checks `EXCEPTION_RECORD` for debugger-specific behavior (single-step flag, guard page violations with debugger semantics).
+
+**Bypass**: Understand the VEH logic and ensure the exception chain behaves identically to non-debugged execution.
+
+---
+
+## 3. ADVANCED MULTI-LAYER TECHNIQUES
+
+### 3.1 Self-Debugging (fork + ptrace)
+
+The process forks a child that attaches to the parent via ptrace. If an external debugger is already attached, the child's ptrace fails.
+
+```c
+pid_t child = fork();
+if (child == 0) {
+    if (ptrace(PTRACE_ATTACH, getppid(), 0, 0) == -1)
+        kill(getppid(), SIGKILL);
+    else
+        ptrace(PTRACE_DETACH, getppid(), 0, 0);
+    _exit(0);
+}
+wait(NULL);
+```
+
+**Bypass**: Patch the `fork()` return or kill/detach the watchdog child.
+
+### 3.2 Multi-Process Debugging Detection
+
+Parent and child cooperatively check each other's debug state, creating a mutual-watch pattern.
+
+**Bypass**: Attach to both processes (GDB `follow-fork-mode`, or two debugger instances).
+
+### 3.3 Timing-Based with Multiple Checkpoints
+
+Distributes timing checks across multiple functions, comparing cumulative drift. Single patches fail because the total still exceeds threshold.
+
+**Bypass**: Frida `Interceptor.replace` all timing sources (`rdtsc`, `clock_gettime`, `QueryPerformanceCounter`) to return controlled values.
+
+### 3.4 Nanomite / INT3 Patching
+
+Original conditional jumps are replaced with `INT3` (0xCC). A parent debugger process handles each `INT3`, evaluates the condition, and sets the child's EIP accordingly.
+
+**Bypass**: Reconstruct the original jump table by tracing all `INT3` handlers, then patch the binary.
+
+---
+
+## 4. COUNTERMEASURE TOOLS
+
+| Tool | Platform | Capability |
+|---|---|---|
+| **ScyllaHide** | Windows (x64dbg/IDA/OllyDbg) | Auto-patches PEB, hooks NtQuery*, hides threads, fixes timing |
+| **TitanHide** | Windows (kernel driver) | Kernel-level hiding for all user-mode checks |
+| **Frida** | Cross-platform | Script-based hooking of any function, timing spoofing |
+| **LD_PRELOAD shims** | Linux | Replace ptrace, getenv, fopen at load time |
+| **GDB scripts** | Linux | `catch syscall`, conditional BP, register fixup |
+| **Qiling** | Cross-platform | Full-system emulation, bypass all hardware checks |
+
+---
+
+## 5. SYSTEMATIC BYPASS METHODOLOGY
+
+```
+Step 1: Static analysis — identify anti-debug calls
+  └─ Search for: ptrace, IsDebuggerPresent, NtQuery, rdtsc,
+     GetTickCount, SIGTRAP, INT 2D, TLS directory entries
+
+Step 2: Classify each check
+  ├─ API-based → hook or patch the call
+  ├─ Flag-based → patch PEB/proc fields
+  ├─ Timing-based → spoof time source
+  ├─ Exception-based → forward/handle exception correctly
+  └─ Multi-process → handle both processes
+
+Step 3: Apply bypass (order matters)
+  1. Load ScyllaHide / set LD_PRELOAD (covers 80% of checks)
+  2. Handle TLS callbacks (break before main)
+  3. Patch remaining custom checks (Frida or binary patch)
+  4. Verify: run with breakpoints, confirm no premature exit
+
+Step 4: Validate bypass completeness
+  └─ Set BP on ExitProcess/exit/_exit — if hit unexpectedly,
+     a check was missed → trace back from exit call
+```
+
+---
+
+## 6. DECISION TREE
+
+```
+Binary exits/crashes under debugger?
+│
+├─ Crashes immediately before main?
+│  └─ TLS callback anti-debug
+│     └─ Enable TLS callback breaking in debugger
+│
+├─ Crashes at startup?
+│  ├─ Linux: check for ptrace(TRACEME)
+│  │  └─ LD_PRELOAD hook or NOP patch
+│  └─ Windows: check IsDebuggerPresent / PEB
+│     └─ ScyllaHide or manual PEB patch
+│
+├─ Crashes after some execution?
+│  ├─ Consistent crash point → API-based check
+│  │  ├─ NtQueryInformationProcess → hook return values
+│  │  ├─ /proc/self/status → filter TracerPid
+│  │  └─ Hardware BP detection → hook GetThreadContext
+│  │
+│  ├─ Variable crash point → timing-based check
+│  │  └─ Hook rdtsc / QueryPerformanceCounter
+│  │
+│  └─ Crash on breakpoint hit → exception-based check
+│     ├─ INT 2D / INT 3 trick → handle in VEH
+│     └─ SIGTRAP handler → GDB: handle SIGTRAP pass
+│
+├─ Debugger loses control silently?
+│  └─ ThreadHideFromDebugger
+│     └─ Hook NtSetInformationThread
+│
+├─ Child process detects and kills parent?
+│  └─ Self-debugging (fork+ptrace)
+│     └─ Patch fork() or handle both processes
+│
+└─ All basic bypasses applied but still detected?
+   └─ Multi-layer / custom checks
+      ├─ Use Frida for comprehensive API hooking
+      ├─ Full emulation with Qiling
+      └─ Trace all calls to exit/abort to find remaining checks
+```
+
+---
+
+## 7. CTF & REAL-WORLD PATTERNS
+
+### Common CTF Anti-Debug Patterns
+
+| Pattern | Frequency | Quick Bypass |
+|---|---|---|
+| Single `ptrace(TRACEME)` | Very common | `LD_PRELOAD` one-liner |
+| `IsDebuggerPresent` + `NtGlobalFlag` | Common | ScyllaHide |
+| rdtsc timing in loop | Moderate | Patch comparison threshold |
+| signal(SIGTRAP) + raise | Moderate | GDB signal forwarding |
+| fork + ptrace watchdog | Rare but tricky | Kill child or patch fork |
+| Nanomite INT3 replacement | Rare (advanced) | Reconstruct jump table |
+
+### Real-World Protections
+
+| Protector | Primary Anti-Debug | Recommended Tool |
+|---|---|---|
+| VMProtect | PEB + timing + driver-level | TitanHide + ScyllaHide |
+| Themida | Multi-layer PEB + SEH + timing | ScyllaHide + manual patches |
+| Enigma Protector | IsDebuggerPresent + CRC checks | x64dbg + ScyllaHide |
+| UPX (custom) | Usually none (just packing) | Standard unpack |
+| Custom (malware) | Varies widely | Frida + Qiling for analysis |
+
+---
+
+## 8. QUICK REFERENCE — BYPASS CHEAT SHEET
+
+### Linux One-Liners
+
+```bash
+# LD_PRELOAD anti-ptrace
+echo 'long ptrace(int r, ...) { return 0; }' > /tmp/ap.c
+gcc -shared -o /tmp/ap.so /tmp/ap.c
+LD_PRELOAD=/tmp/ap.so ./target
+
+# GDB: catch and bypass ptrace
+(gdb) catch syscall ptrace
+(gdb) commands
+> set $rax = 0
+> continue
+> end
+```
+
+### Frida Anti-Debug Bypass (Cross-Platform)
+
+```javascript
+// Hook IsDebuggerPresent (Windows)
+Interceptor.replace(
+  Module.getExportByName('kernel32.dll', 'IsDebuggerPresent'),
+  new NativeCallback(() => 0, 'int', [])
+);
+
+// Hook ptrace (Linux)
+Interceptor.replace(
+  Module.getExportByName(null, 'ptrace'),
+  new NativeCallback(() => 0, 'long', ['int', 'int', 'pointer', 'pointer'])
+);
+
+// Timing spoof
+Interceptor.attach(Module.getExportByName(null, 'clock_gettime'), {
+  onLeave(retval) {
+    // manipulate timespec to hide debugger delay
+  }
+});
+```
+
+### x64dbg ScyllaHide Quick Setup
+
+1. Plugins → ScyllaHide → Options
+2. Check: PEB BeingDebugged, NtGlobalFlag, HeapFlags
+3. Check: NtQueryInformationProcess (all classes)
+4. Check: NtSetInformationThread (HideFromDebugger)
+5. Check: GetTickCount, QueryPerformanceCounter
+6. Apply → restart debugging session

package/skills/api-auth-and-jwt-abuse/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: api-auth-and-jwt-abuse
+description: >-
+  API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.gated: true
+---
+
+# SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits
+
+> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.
+
+## 1. TOKEN TRIAGE
+
+Inspect:
+
+- `alg`, `kid`, `jku`, `x5u`
+- role, org, tenant, scope, or privilege claims
+- issuer and audience mismatches
+- reuse of mobile and web tokens across products
+
+## 2. QUICK ATTACK PICKS
+
+| Pattern | First Test |
+|---|---|
+| `alg:none` acceptance | unsigned token with trailing dot |
+| RS256 confusion | switch to HS256 using public key as secret |
+| `kid` lookup trust | path traversal or injection in `kid` |
+| remote key fetch trust | attacker-controlled `jku` or `x5u` |
+| weak secret | offline crack with targeted wordlists |
+
+## 3. HIDDEN FIELDS AND BATCH ABUSE
+
+### Mass assignment field picks
+
+```text
+role
+isAdmin
+admin
+verified
+plan
+tier
+permissions
+org
+owner
+```
+
+### Rate limit and batch abuse picks
+
+```text
+X-Forwarded-For: 1.2.3.4
+X-Real-IP: 5.6.7.8
+Forwarded: for=9.9.9.9
+```
+
+GraphQL or JSON batch abuse candidates:
+
+- arrays of login mutations
+- bulk object fetches with varying IDs
+- repeated password reset or verification calls in one request
+
+## 4. RATE LIMIT BYPASS FAMILIES
+
+```text
+X-Forwarded-For
+X-Real-IP
+Forwarded
+User-Agent rotation
+Path case / slash variants
+```
+
+## 5. NEXT ROUTING
+
+- For GraphQL batching and hidden parameters: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
+- For default credential and brute-force planning: [authentication bypass](../authbypass-authentication-flaws/SKILL.md)
+- For full JWT and OAuth depth: [jwt oauth token attacks](../jwt-oauth-token-attacks/SKILL.md)
+- For OAuth or OIDC configuration flaws in browser and SSO flows: [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md)
+- For credentialed browser reads and origin trust bugs: [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md)

package/skills/api-authorization-and-bola/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: api-authorization-and-bola
+description: >-
+  API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.gated: true
+---
+
+# SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
+
+> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
+
+## 1. CORE TEST LOOP
+
+1. Create Account A and Account B.
+2. As Account A, capture create, read, update, and delete flows.
+3. Replay with Account B's token.
+4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
+
+## 2. TEST SURFACES
+
+| Surface | Example |
+|---|---|
+| object read | `/api/v1/orders/123` |
+| nested object | `/api/v1/users/1/invoices/9` |
+| admin or internal function | `/api/v1/admin/users` |
+| update path | `PUT`, `PATCH`, `DELETE` variants |
+| hidden JSON fields | `role`, `org`, `verified`, `tier` |
+
+## 3. QUICK PAYLOADS
+
+```json
+{"role":"admin"}
+{"isAdmin":true}
+{"org":"target-company"}
+{"verified":true}
+```
+
+## 4. WHAT TESTERS MISS
+
+- object IDs in headers, cookies, GraphQL args, and nested objects
+- alternate methods sharing the same route but weaker authz
+- parent check present, child resource check missing
+- admin docs revealing extra writable fields
+
+## 5. NEXT ROUTING
+
+- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
+- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
+- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)

package/skills/api-recon-and-docs/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: api-recon-and-docs
+description: >-
+  API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.gated: true
+---
+
+# SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface
+
+> **AI LOAD INSTRUCTION**: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.
+
+## 1. PRIMARY GOALS
+
+1. Discover all reachable API entrypoints.
+2. Extract schemas, optional fields, and role differences.
+3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.
+
+## 2. RECON CHECKLIST
+
+### JavaScript and client mining
+
+```bash
+curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u
+```
+
+### Common documentation and schema paths
+
+```text
+/swagger.json
+/openapi.json
+/api-docs
+/docs
+/.well-known/
+/graphql
+/gql
+```
+
+### Version and product drift
+
+```text
+/api/v1/
+/api/v2/
+/api/mobile/v1/
+/legacy/
+```
+
+## 3. WHAT TO EXTRACT FROM DOCS
+
+- optional and undocumented fields
+- admin-only request examples
+- deprecated endpoints that may still be active
+- schema hints like `additionalProperties: true`
+- parameter names tied to filtering, sorting, IDs, roles, or tenancy
+
+## 4. NEXT ROUTING
+
+| Finding | Next Skill |
+|---|---|
+| object IDs everywhere | [api authorization and bola](../api-authorization-and-bola/SKILL.md) |
+| JWT, OAuth, role claims | [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md) |
+| GraphQL or hidden fields | [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md) |
+| strong auth boundary but suspicious business flow | [business logic vulnerabilities](../business-logic-vulnerabilities/SKILL.md) |

package/skills/api-sec/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: api-sec
+description: >-
+  Entry P1 category router for API security. Use when choosing between API
+  recon, authorization, token abuse, and hidden-parameter workflows before any
+  deeper API topic skill.gated: true
+---
+
+# API Security Router
+
+This is the routing entry point for API security testing.
+
+Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill.
+
+## When to Use
+
+- The target exposes REST APIs, mobile backends, or GraphQL endpoints
+- You need to define API testing order before going into specific topics
+- You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks
+
+## Skill Map
+
+- [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation
+- [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields
+- [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass
+- [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters
+
+## Quick Triage
+
+| Observation | Route |
+|---|---|
+| Swagger or OpenAPI is present | [api-recon-and-docs](../api-recon-and-docs/SKILL.md) |
+| IDs appear in URL, JSON, headers, or GraphQL args | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) |
+| JWT token visible in traffic | [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) |
+| `/graphql` or batched JSON arrays are present | [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/SKILL.md) |
+| Registration, login, or profile updates accept extra fields | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) then [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) |
+
+## Recommended Flow
+
+1. Start with exposed endpoints and documentation assets
+2. Then evaluate object-level and function-level authorization
+3. Then evaluate token, header, signature, and rate-limit boundaries
+4. If GraphQL or complex JSON is present, continue with hidden fields and schema abuse
+
+## Related Categories
+
+- [auth-sec](../auth-sec/SKILL.md)
+- [business-logic-vuln](../business-logic-vuln/SKILL.md)
+- [recon-for-sec](../recon-for-sec/SKILL.md)