Skill UI

This skill provides a comprehensive operational checklist for identifying and exploiting HTTP Parameter Pollution (HPP) vulnerabilities. It details how various web technologies (ASP.NET, PHP, Python, etc.) handle duplicate parameters differently (e.g., first-wins, last-wins, concatenation). Use this skill during penetration testing to discover flaws in parameter parsing, which can lead to bypassing WAFs, performing logic manipulation, or achieving unauthorized access.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A comprehensive guide to advanced SQL injection (SQLi) methodologies for offensive security assessments and bug bounty hunting. Covers all major injection types, including error-based, boolean/time-based blind, out-of-band, and second-order injection. Provides specific payloads and techniques for MySQL, MSSQL, PostgreSQL, Oracle, and NoSQL databases, along with methods for bypassing WAFs, exploiting GraphQL, WebSocket, and modern API filters. Includes full automation workflows using tools like sqlmap.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This skill provides comprehensive strategies for testing OneNote integrations within CI/CD pipelines. It supports mock-only PR checks using MSW for zero-dependency testing, and robust live integration tests for nightly builds using Azure AD credentials. Ideal for automating quality assurance when connecting OneNote features via the Graph API.

This skill provides a comprehensive guide to setting up robust CI/CD pipelines for Oracle Cloud Infrastructure (OCI). It leverages GitHub Actions and Terraform to automate the deployment, planning, and testing of OCI resources. Instructions cover secure API key authentication, best practices for managing Terraform state, and crucial workarounds for known OCI provider bugs, ensuring stable and reliable cloud deployments.

This skill provides a comprehensive guide for safely upgrading the Oracle Cloud Infrastructure (OCI) Python SDK and Terraform provider. It addresses known breaking changes, schema modifications, and version incompatibility issues common in OCI tools. By implementing version pinning, pre-upgrade testing, and structured rollback procedures, users can ensure a stable and reliable migration process for both code and infrastructure definitions.

This skill provides a structured guide for setting up CI/CD pipelines to test Persona identity verification integrations. It demonstrates how to use sandbox API credentials, simulate webhooks, and run comprehensive integration tests. It is essential for developers ensuring the reliability and security of KYC/identity services before deployment.

This guide provides a comprehensive workflow for developing and testing with Persona's identity verification services in a controlled sandbox environment. It details setting up local environment variables, tunneling webhooks using ngrok, creating test inquiries via API, and mocking API responses for robust unit and integration testing.

Provides comprehensive strategies for migrating embedding models within Qdrant. This guide covers zero-downtime alias swapping, side-by-side A/B testing, and transitioning from dense to hybrid search. It is essential for production environments requiring continuous availability when updating models, dimensions, or switching providers.