Skill UI

Learn how to integrate AFL++ (American Fuzzy Lop Plus Plus) into Continuous Integration/Continuous Deployment (CI/CD) pipelines. This guide details the process of using coverage-guided fuzzing to discover critical vulnerabilities, such as memory corruption, input handling flaws, and logic bugs, in compiled C/C++ applications that process untrusted input.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

A comprehensive deep dive into reverse engineering ransomware encryption mechanisms. It details the analysis of hybrid encryption models (AES/RSA), identifying specific cryptographic APIs (CryptoAPI, CNG), and locating implementation flaws such as weak key generation or IV reuse. This guides authorized security professionals in finding potential decryption opportunities without paying a ransom.

A comprehensive framework for testing REST and GraphQL APIs against Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR). This tool simulates an attacker's behavior by systematically intercepting and modifying object identifiers (IDs, UUIDs, slugs) within API calls. It helps identify critical authorization flaws, ensuring that an authenticated user cannot access or modify resources belonging to other tenants or users, adhering to OWASP API Security Top 10.

A comprehensive guide for advanced penetration testing designed to identify flaws in application business rules that automated scanners miss. Focus areas include price manipulation, workflow bypass, privilege escalation, and race conditions. Essential for securing e-commerce platforms, financial systems, and multi-step critical processes.

This skill provides a comprehensive methodology for identifying and exploiting open redirect vulnerabilities in web applications. It covers advanced bypass techniques (e.g., URL encoding, protocol-relative URLs, path traversal) and demonstrates chaining with other flaws like OAuth redirection for advanced phishing simulations and token theft. Designed for authorized security professionals conducting penetration tests.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

This comprehensive tool assesses critical security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. It systematically tests for common vulnerabilities like authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, and scope escalation. Ideal for penetration testers and security engineers evaluating the robustness of identity providers and client applications.

A guide for security researchers focused on finding exploitable, remote-reachable vulnerabilities for bug bounties or responsible disclosure. It emphasizes high-signal flaws such as SSRF, RCE, and SQL injection, while guiding users through the professional triage and PoC creation process for penetration testing.

This comprehensive checklist guides users through identifying and exploiting open redirect vulnerabilities in web applications. It covers parameter identification, advanced bypass techniques (e.g., URL encoding, CRLF injection), and chaining the vulnerability with other flaws like OAuth or SSRF. Ideal for web application penetration testing and bug bounty hunting.

This skill provides a comprehensive operational checklist for identifying and exploiting HTTP Parameter Pollution (HPP) vulnerabilities. It details how various web technologies (ASP.NET, PHP, Python, etc.) handle duplicate parameters differently (e.g., first-wins, last-wins, concatenation). Use this skill during penetration testing to discover flaws in parameter parsing, which can lead to bypassing WAFs, performing logic manipulation, or achieving unauthorized access.