inventory-api-discovery

Inventory API Discovery

Discover and catalog all API endpoints across REST, GraphQL, SOAP, and WebSocket protocols. Find API documentation, version endpoints, and undocumented routes. Produce a structured inventory that feeds downstream injection, IDOR, and authentication testing.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md
   

2. Check for openly accessible API documentation first — documentation is the best map:

   # OpenAPI / Swagger
   curl -so /dev/null -w "%{http_code}" https://TARGET/swagger.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/swagger.yaml
   curl -so /dev/null -w "%{http_code}" https://TARGET/openapi.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/openapi.yaml
   curl -so /dev/null -w "%{http_code}" https://TARGET/api-docs
   curl -so /dev/null -w "%{http_code}" https://TARGET/api/swagger-ui.html
   curl -so /dev/null -w "%{http_code}" https://TARGET/v1/swagger.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/v2/swagger.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/v3/swagger.json
   # WSDL / SOAP
   curl -so /dev/null -w "%{http_code}" https://TARGET/service.wsdl
   curl -so /dev/null -w "%{http_code}" "https://TARGET/ws?wsdl"
   # Postman / Insomnia
   curl -so /dev/null -w "%{http_code}" https://TARGET/postman_collection.json
   

   For any path returning 200, fetch the full document:

   curl -s https://TARGET/openapi.json | tee outputs/ENGAGEMENT/activity/openapi-TARGET.json
   

3. Probe for GraphQL endpoint:

   curl -so /dev/null -w "%{http_code}" https://TARGET/graphql
   curl -so /dev/null -w "%{http_code}" https://TARGET/api/graphql
   curl -so /dev/null -w "%{http_code}" https://TARGET/query
   

4. Probe for common REST API root paths:

   for path in /api /api/v1 /api/v2 /api/v3 /rest /v1 /v2 /v3 /service /services /endpoint; do
     status=$(curl -so /dev/null -w "%{http_code}" https://TARGET${path})
     echo "${path}: ${status}"
   done 2>&1 | tee outputs/ENGAGEMENT/activity/api-probes-TARGET.txt
   

5. Log:

   {"timestamp":"...","agent":"inventory-api-discovery","action":"recon","target":"https://TARGET","swagger_found":true,"graphql_found":false,"api_roots":["/api/v1","/api/v2"]}