Skill UI

AddressSanitizer accelerates fuzz testing by instrumenting C/C++ and unsafe Rust code to detect buffer overflows, use-after-free, and related memory corruption bugs at runtime, with configurable ASAN_OPTIONS for verbosity, abort behavior, and leak control.

Guides bug bounty hunters through API fuzzing and penetration testing, covering REST, SOAP, and GraphQL recon, authentication bypass, IDOR methods, injections, method abuse, GraphQL attacks, and payload delivery techniques.

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

This skill simulates a senior Go developer, specializing in writing high-performance, production-grade Go applications. It covers advanced topics like concurrent programming using goroutines and channels, designing robust microservices with gRPC/REST, and optimizing code using pprof and benchmarks. It enforces idiomatic Go patterns, context propagation, and strict testing practices (table-driven, fuzzing, race detection).

LibFuzzer is LLVM’s in-process coverage-guided fuzzer for C/C++ projects compiled with Clang, providing a quick harness-based setup that can later transition to more advanced fuzzers while maintaining reproducible, high-throughput testing.

OSS-Fuzz gives open-source teams free distributed infrastructure for continuous fuzz testing, letting you build Docker images, compile sanitizing fuzzers, run harnesses, and review coverage/bugs through the helper.py CLI instead of hosting your own servers.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Master advanced testing strategies for smart contracts using industry-leading frameworks like Hardhat and Foundry. This skill covers unit testing, integration testing, gas optimization analysis, fuzzing for edge cases, and simulating real-world mainnet interactions via forking. Ideal for ensuring the security and reliability of decentralized applications (DApps).

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Learn how to integrate AFL++ (American Fuzzy Lop Plus Plus) into Continuous Integration/Continuous Deployment (CI/CD) pipelines. This guide details the process of using coverage-guided fuzzing to discover critical vulnerabilities, such as memory corruption, input handling flaws, and logic bugs, in compiled C/C++ applications that process untrusted input.