Skill UI

Explains how to create route.ts endpoints in the Next.js App Router, covering HTTP methods, request/response handling, streaming, cookies, redirects, CORS, and caching so you can build REST APIs.

This skill scans web application endpoints and cookies to spot missing CSRF safeguards—tokens, double-submit cookies, SameSite attributes, and origin checks—then documents vulnerable paths and mitigation steps for security reviews.

A comprehensive guide for developers on handling sensitive data and ensuring compliance with major privacy regulations like GDPR and CCPA when deploying serverless functions on Vercel. Learn techniques for PII redaction in logs, implementing data subject rights (Right to Access/Erasure), securing session cookies, and configuring data residency to meet global privacy standards.

A comprehensive guide for authorized penetration testers on identifying and exploiting insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET). Covers techniques for generating payloads using tools like ysoserial and phpggc, and testing various application components such as cookies, HTTP parameters, and message queues to achieve potential Remote Code Execution (RCE).

EvilGinx3 is an advanced Adversary-in-the-Middle (AiTM) framework designed for red teaming simulations. It goes beyond traditional credential harvesting by acting as a transparent proxy to intercept the entire authentication flow, including session cookies and Multi-Factor Authentication (MFA) tokens. This capability allows security professionals to assess the robustness of an organization's security posture against sophisticated account takeover attacks.

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

An expert playbook for systematically testing Insecure Direct Object References (IDOR) and Broken Object/Function Level Authorization (BOLA/BFLA). This guide covers finding object identifiers across all request vectors (URL, body, headers, cookies), implementing A-B testing methodologies, identifying various ID patterns, and executing horizontal or vertical privilege escalation attacks. Essential for deep API security auditing.

This skill probes website authentication flows to identify security vulnerabilities like CSRF, redirect leaks, weak cookies, and OAuth misconfigurations. It automates login processes, analyzes trajectories, and generates structured findings reports. Suitable for pre-deployment audits, investigating token leaks, and regression testing. Sensitive data is quarantined and never exposed unredacted.

Drives a site authentication flow once, sanitizes cookies through AIDefence, and vaults a reusable cookie handle in AgentDB so later browser skills can reuse the session without re-authenticating.

A specialized skill for analyzing client-side persistence mechanisms, including cookies, localStorage, sessionStorage, IndexedDB, and Service Workers. It is crucial for security testing and CTF environments where application behavior or critical decision branches are determined by stored session state, cached data, or local client-side variables. Use this to trace the smallest stateful sequence leading to a decisive outcome.

A specialized, downstream skill designed for forensic analysis within a confined sandbox environment, particularly for CTF challenges. It guides the user to inspect the full stack behavior, including API interactions, server routing, browser state (cookies, local storage), and asynchronous worker processes. Use this skill to trace complex, end-to-end request flows, debug authentication/session leaks, or diagnose discrepancies between frontend UI and backend enforcement.

This skill outlines a discipline for capturing and redacting evidence in bug bounty submissions. It guides users on masking sensitive data like session cookies and PII while preserving triage-useful metadata. It covers protocols for screenshots, HAR files, and HTTP requests to prevent data leaks.