Skill UI

Provides step-by-step API fuzzing and exploitation tactics for REST, SOAP, and GraphQL during bug bounty or penetration tests, covering reconnaissance, auth bypass, IDOR, injection, and GraphQL-specific attacks.

Guides bug bounty hunters through API fuzzing and penetration testing, covering REST, SOAP, and GraphQL recon, authentication bypass, IDOR methods, injections, method abuse, GraphQL attacks, and payload delivery techniques.

A comprehensive guide for engineering teams to manage critical incidents related to Clerk authentication and SaaS platform outages. It covers full incident lifecycle procedures, including initial triage, emergency auth bypass implementation, key rotation, session recovery scripts, and post-incident root cause analysis. Use this when facing production authentication failures or security breaches.

A comprehensive runbook for handling CodeRabbit service outages or malfunctions. It provides step-by-step procedures for quick triage, emergency bypasses (P1), checking installation health (P2), diagnosing delays (P3), and tuning incorrect review behavior (P4). Essential for maintaining continuous CI/CD workflows when the review bot fails.

Technique for bypassing checksums, PRNGs, and global-state guards during fuzzing by conditionally compiling test-only patches so the fuzzer can explore deeper code while production behavior stays unchanged.

A production-grade framework for executing high-performance, robust browser automation and web scraping using Playwright with the Go language. This skill specializes in handling complex Single Page Applications (SPAs), emulating human behavior (e.g., random typing delays, Bezier mouse movements), and implementing advanced stealth techniques to bypass anti-bot systems like Cloudflare. It emphasizes architectural best practices, such as using contexts for isolation and structured logging.

A comprehensive guide for deploying PostHog analytics platform across diverse production environments. Covers advanced configurations for Next.js/Vercel (including reverse proxy for ad blocker bypass and edge functions for server-side capture), self-hosted setups using Docker, and deployment patterns for Google Cloud Run. Ensures robust, reliable user behavior tracking regardless of the hosting platform.

Guides bug bounty hunters through REST, SOAP, and GraphQL API fuzzing to uncover authentication weaknesses, IDOR, injections, and endpoint bypasses while outlining practical reconnaissance and exploitation workflows.

A powerful toolkit utilizing Objection and Frida for authorized mobile penetration testing. It enables deep runtime analysis of iOS applications, allowing users to inspect sensitive data in the keychain, filesystem, and memory. Key capabilities include bypassing client-side protections such as SSL pinning and jailbreak detection without requiring source code access.

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.