Skill UI

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A comprehensive reference and bypass catalog covering modern operating system kernel mitigations such as KASLR, SMAP, SMEP, KPTI, DEP/NX, and CFI. It details how these security mechanisms function, how to detect their presence, and advanced bypass techniques (e.g., side-channel attacks, ROP chains, information leaks). This skill is essential for security professionals conducting deep penetration testing, exploit development, and target hardening assessments.

A comprehensive methodology for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, code leaks, infrastructure mapping, cryptocurrency tracing, and geospatial intelligence. Essential for building detailed attack-surface maps against organizations or individuals.

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This guide provides comprehensive instructions on implementing secure authentication and managing the token lifecycle for the OneNote Graph API. It details the mandatory shift from deprecated app-only authentication to delegated authentication using MSAL, ensuring compliance with modern OAuth 2.0 standards. Key topics include establishing least-privilege permission scopes, handling token renewal, and securely storing credentials using environment variables or Azure Key Vault. Essential for developers building resilient and compliant OneNote integrations.

This skill provides a comprehensive Python guide to building a production-ready Virtual Cloud Network (VCN) on Oracle Cloud Infrastructure (OCI). It details the entire process from scratch, including creating the VCN, setting up Internet and NAT Gateways, configuring route tables, and defining Network Security Groups (NSGs). This is essential for engineers needing to provision complex, secure, and highly functional network architectures for development or production use.

This framework implements the OWASP Top 10 standards, specifically tailored for Agentic Applications. It provides a standardized methodology to classify and map diverse security findings—such as prompt injection, tool misuse, and privilege abuse—to ten core risk categories (ASI01-ASI10). It is essential for security teams to systematically assess, prioritize, and remediate vulnerabilities inherent in complex AI agent systems.

This guide details best practices for securing Persona identity verification implementations. It covers critical security measures such as API key rotation, webhook HMAC verification, encrypting Personally Identifiable Information (PII) at rest, and maintaining comprehensive audit logs. Use this when integrating Persona into a production system requiring high data security and compliance.

This guide provides implementation patterns for secure integration with the Podium API using REST API calls. It focuses on establishing robust connections with OAuth2 authentication for managing core business functions, including messaging, retrieving customer reviews, and processing payments. It also details essential error handling strategies.

Provides foundational knowledge and implementation patterns for connecting to the Procore API. This skill details how to securely implement OAuth2 authentication (using the Client Credentials flow) to manage data in critical construction processes, including project tracking, RFIs, and document submittals.