Skill UI

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Common tools include Burp Suite and Hydra. It is used for security assessments to prevent account takeover and unauthorized access.

Execute comprehensive web application security testing with Burp Suite, covering HTTP interception, request modification, Repeater, scope filtering, and vulnerability scanning for authorized assessments.

A command-line utility to search and extract data from Burp Suite project files (.burp). It enables searching response headers or bodies with regex patterns, extracting security audit findings, and analyzing HTTP traffic. Requires Burp Suite Professional and a specific extension. Use sub-component filters to avoid large data dumps.

Perform dynamic application security testing against running web apps using OWASP ZAP, Burp Suite, Nikto, Nuclei, and Arachni. Automate baseline, full, and API scans in CI/CD to find runtime vulnerabilities.

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

Assess WordPress installations for common vulnerabilities and attack surfaces. Use this skill for authorized security assessments, penetration testing, and defensive validation. Includes WPScan, Metasploit, and Burp Suite integration with legal and technical constraints.