Download

Skill UI

Browse and discover 10323+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search CTI , found 4095 results

Default Newest Most Downloaded

API Authorization and BOLA Testing

api-authorization-and-bola

yaklang/hack-skills

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

Arbitrary Write To Code Execution Playbook

arbitrary-write-to-rce

yaklang/hack-skills

This expert playbook details advanced techniques for converting an arbitrary memory write primitive into full Remote Code Execution (RCE). It covers targeting multiple system structures across different glibc versions, including GOT entries, __malloc_hook, __free_hook, _IO_FILE vtables, and function arrays. Essential for exploiting modern, hardened binaries and mastering advanced binary exploitation.

Authentication Bypass Security Testing Playbook

authbypass-authentication-flaws

yaklang/hack-skills

A comprehensive playbook for identifying authentication vulnerabilities in web applications. Covers advanced topics including SQL injection login bypass, predictable password reset tokens, account enumeration techniques, multi-factor authentication bypass, and brute-force resistance checks. Essential for penetration testers assessing login mechanisms and session management.

Clickjacking Attack Playbook

yaklang/hack-skills

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

Expert Guide to OS Command Injection

cmdi-command-injection

yaklang/hack-skills

A comprehensive playbook detailing expert techniques for OS command injection vulnerabilities. It covers all shell metacharacters, blind injection, time-based detection, out-of-band exfiltration methods, and common vulnerable code patterns across PHP, Python, and Node.js. Essential for security analysts and penetration testers.

Cross-Origin Misconfiguration Testing Guide

cors-cross-origin-misconfiguration

yaklang/hack-skills

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

Advanced Content Security Policy Bypass Techniques

csp-bypass-advanced

yaklang/hack-skills

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

CSV and Spreadsheet Formula Injection Testing

csv-formula-injection

yaklang/hack-skills

This skill details advanced techniques for exploiting formula injection vulnerabilities within CSV, Excel, LibreOffice, and Google Sheets environments. It covers DDE, obfuscation methods, and high-risk functions like IMPORT* that can be triggered when user-controlled data is exported or imported into spreadsheet software. Use this for penetration testing of data pipelines and export features.

Dangling Markup Exfiltration Without JavaScript

dangling-markup-injection

yaklang/hack-skills

A powerful technique used when full XSS is blocked by CSP, sanitizers, or WAFs, but HTML injection is possible. It leverages unclosed HTML tags (like <img> or <link>) to capture and exfiltrate sensitive page data (CSRF tokens, session IDs, form values) by forcing the browser to include the subsequent content in a request URL.

DeFi Attack Patterns Expert Playbook

defi-attack-patterns

yaklang/hack-skills

A comprehensive playbook detailing advanced exploitation techniques in decentralized finance (DeFi). Covers flash loan mechanics, price oracle manipulation (spot vs. TWAP), MEV extraction strategies (Sandwich, JIT), governance exploits, and core smart contract vulnerabilities. Essential for security auditors and risk analysts.

Expert Deserialization Exploitation Playbook

deserialization-insecure

yaklang/hack-skills

A comprehensive playbook detailing advanced techniques for exploiting insecure deserialization flaws across Java, PHP, and Python. It covers traffic fingerprinting, identifying specific gadget chains (e.g., Commons Collections, Shiro), and utilizing tools like ysoserial to achieve Remote Code Execution (RCE) and privilege escalation.

Advanced Email Header Injection And Spoofing

email-header-injection

yaklang/hack-skills

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

Prev 1 2 3...317 318 319320321 322 323...340 341 342 Next

Language