domains / families / security / hunt-schema-enumeration

hunt-schema-enumeration

separate

Enumerate hidden tables, fields, and endpoints via API error hints. Agnostic across PostgREST, Zod, FastAPI, GraphQL, and REST.

When to use

• The target API returns structured error messages (JSON) that hint at valid table names, field names, or endpoint paths. This is the single most productive black-box recon technique for REST/GraphQL APIs — one fuzz request reveals the entir…

When not to use

• Schema enumeration without sensitive fields
• GraphQL schema via introspection
• Database schema via error messages
• OpenAPI spec publicly accessible

Skill page

Source