Skill UI

Techniques for bypassing Web Application Firewalls using encoding, HTTP tricks, payload splitting, and SQLMap tamper scripts to deliver SQLi and XSS payloads during penetration tests and red-team engagements.

Guides cloud security teams through setting up Microsoft Defender for Cloud to protect Azure workloads, extend CNAPP coverage to AWS/GCP, manage Secure Score, and monitor threats centrally via the unified Defender portal.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.

Guides penetration testers through discovering and exploiting XML External Entity vulnerabilities across APIs, file uploads, and SOAP services to read files, trigger SSRF, and exfiltrate data with tools like Burp Suite, interactsh, and custom payloads.

Evaluates WebSocket APIs for auth bypass, CSWSH, injection, DoS, and leakage by intercepting handshakes and messages with Burp Suite plus crafted payloads.

Implements AWS Nitro Enclave deployments with PCR-aware attestation, KMS key policies, and secure vsock communication so sensitive workloads stay isolated and auditable.

Guides calling Feishu IM APIs to retrieve chat histories, thread replies, cross-chat searches, and media/file downloads while handling pagination, time filters, and permission constraints so agents can answer questions about past conversations.

Guides Flutter teams through integrating Cloud Firestore, configuring secure rules, modeling collections, and performing efficient reads/writes or real-time listeners while highlighting scaling, indexing, and transaction advice.

Guides setting up Firebase Crashlytics in Flutter, covering dependency setup, fatal/non-fatal/isolate error handlers, custom keys/logs/user identifiers, symbol uploads for obfuscation, opt-in reporting controls, and testing workflows for reliable diagnostics.

Guides integrating Firebase Cloud Storage with Flutter apps, covering setup, uploads/downloads, metadata, error handling, and security best practices for file management workflows.

Accelerates GitHub cloning, release/raw/archive downloads, and other resource access for Mainland China users by rewriting URLs through githubproxy.cc or fallback ghfast.top, with an optional URL converter script for quick adaptation.