Skip to content

Module 09 — API Fuzzing & External Tool Integration

Icon: ⌨ Command Line   |   Colour: Gray

Overview

Performs directory brute-forcing, HTTP method testing, content-type fuzzing (including XXE), and integrates with external security tools like Nikto and Nuclei.

How It Works

  1. HTTP method testing — sends TRACE, DEBUG, TRACK, and CONNECT requests to check for dangerous enabled methods.
  2. XXE injection — sends seven content-type variations with XML External Entity payloads to detect XXE vulnerabilities.
  3. Directory brute-forcing — uses tools like gobuster, dirb, or feroxbuster (if available) to discover hidden directories and files.
  4. Nikto scan — runs a Nikto scan (5-minute timeout) to detect known web server vulnerabilities.
  5. Nuclei scan — runs Nuclei templates at all severity levels to detect known CVEs and misconfigurations.

Expected Findings

Finding Severity
XXE injection Critical
Nuclei critical / high finding Critical
Nikto RCE / backdoor Critical
HTTP TRACE enabled Medium
Dangerous HTTP methods enabled Medium
Sensitive directories found Medium

Note

The availability of external tools (Nikto, Nuclei, gobuster) depends on the platform configuration. Findings from these tools are integrated directly into the scan results alongside findings from built-in modules.