Skill UI

A comprehensive guide to configuring a fast, reproducible local development workflow for Webflow Data API v2 integrations. This setup includes TypeScript, hot reloading, Vitest mocking, and ngrok webhook tunneling, enabling developers to establish a rapid iteration cycle for seamless Webflow development and testing.

A comprehensive system for managing API authorization using schema definition. It allows developers to define granular permissions for various entities, supporting scopes like 'full' and 'own'. The system provides injectable abstractions and explicit feature registration, covering schema definition, permission checking (read, write, delete), and testing scenarios.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A practical offensive methodology for Android and iOS app testing. It covers static analysis, Frida/Objection instrumentation, SSL pinning bypass, exported component abuse, insecure storage review, and mobile API reconnaissance for pentest and bug bounty work.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

A comprehensive playbook for API reconnaissance and documentation review. Use this skill early in the testing process to enumerate all reachable endpoints, extract schemas, identify hidden versions (e.g., v1, v2, mobile), and discover undocumented parameters or fields across REST, GraphQL, and mobile APIs. Essential for mapping the full attack surface before deeper exploitation.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

This skill serves as the primary entry point and operating doctrine for authorized security tasks including web testing, API assessment, and penetration testing. It enforces strict authorization, scope management, and safety constraints while routing complex tasks to specialized deep skills like code audit or incident response.