Skill UI

A comprehensive playbook for identifying authentication vulnerabilities in web applications. Covers advanced topics including SQL injection login bypass, predictable password reset tokens, account enumeration techniques, multi-factor authentication bypass, and brute-force resistance checks. Essential for penetration testers assessing login mechanisms and session management.

A comprehensive playbook covering advanced V8 and Chromium exploitation techniques. It details complex vulnerabilities such as JIT type confusion, incorrect bounds elimination, and pointer compression bypass. This guide is essential for understanding the mechanisms required to achieve renderer RCE and sandbox escape in modern browsers.

This playbook is designed for advanced vulnerability assessment, covering flaws invisible to automated scanners. It guides testing for race conditions, complex workflow bypasses, state machine manipulation, financial parameter tampering (e.g., price/quantity manipulation), and coupon/credit abuse in multi-step applications. Essential for deep manual security testing.

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

This expert playbook provides comprehensive techniques for testing Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It covers identifying state-changing endpoints, bypassing anti-CSRF tokens (including missing validation and predictable tokens), and exploiting modern weaknesses like SameSite=Lax via GET methods or misconfigured JSON APIs. Essential reading for security professionals and penetration testers.

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

An expert guide covering advanced exploitation techniques for Expression Language (EL) injection across multiple Java frameworks, including Spring (SpEL), Struts2 (OGNL), and JSP/JSF (Java EL). Details detection methods, sandbox bypasses, and real-world CVE chains for Remote Code Execution (RCE).

A sophisticated payload bypass technique targeting Java applications. It exploits the silent loss of high 8 bits when 16-bit Java characters are cast or written as 8-bit bytes. This allows attackers to bypass WAF/IDS security measures by making the WAF see harmless Unicode, while the backend service processes the original malicious ASCII byte payload. Ideal for blind SQLi, deserialization RCE, and path traversal. This primitive affects major frameworks like Tomcat, Spring, Jackson, and HttpClient.

A comprehensive playbook detailing advanced techniques for exploiting glibc heap vulnerabilities using ptmalloc2. Covers various memory corruption primitives, including Use-After-Free, double free, and overflows. Provides version-specific guidance on bypassing modern protections like safe-linking (glibc >= 2.32) and RCE methods for post-2.34 environments.

HTTP Parameter Pollution (HPP) occurs when a single request contains multiple instances of the same parameter key. Different components in the request path (e.g., WAFs, proxies, application frameworks) may parse these duplicate keys using different rules (first value, last value, array join). This skill teaches how to exploit these discrepancies to bypass security checks, execute SSRF, or manipulate business logic.