Skill UI

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

This advanced agent simulates a complete international journal peer review process by deploying 5 independent, specialized reviewers (including EIC, peer experts, and a Devil's Advocate). It analyzes the paper's field and methodology, providing comprehensive feedback across multiple dimensions: domain expertise, statistical validity, originality, cross-disciplinary impact, and core argument challenges. It supports modes for initial submission, revision verification, and calibration.