Skill UI

Detailed k6 load testing guidance for APIs, WebSocket, and browser scenarios, covering configuration, realistic scenarios, result analysis, and CI/CD integration to catch regressions before release.

Exercises deep link exploitation workflows on Android and iOS mobile apps to discover unauthorized access, injection, hijacking, and redirect flaws by inspecting URI schemes, App/Universal Links, intent filters, and WebView loads; intended for penetration testing of mobile attack surfaces.

Techniques and workflow to find and leverage prototype pollution bugs in JavaScript applications, covering client/server detection, gadget hunting, and payloads for XSS, RCE, and auth bypass during security testing.

Exploit PHP loose comparison type juggling during pentests to bypass authentication, tamper hash checks, and trick access control logic while testing login forms, APIs, or serialized inputs with Burp Suite and payload lists.

Guided workflow for detecting and exploiting second-order SQL injection flaws by storing malicious payloads, triggering them later via admin/search/report paths, and leveraging SQLMap or blind techniques during penetration testing.

Guides security testers through identifying XML interfaces, crafting XXE/XPath payloads, and validating defenses against entity-based data leaks, SSRF, and XML bomb attacks in SOAP/XML workflows.

Assesses web apps for XSS by mapping injection points, crafting context-aware payloads, bypassing sanitization/CSP protections, and demonstrating client-side execution or session hijack risks.

Guides authorized penetration testers through identifying XML processing points and exploiting XXE injection to read files, trigger SSRF, or exfiltrate data via blind/out‑of‑band techniques using Burp Suite, interactsh, and custom payloads.