Skill UI

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

A comprehensive guide detailing advanced offensive fuzzing methodologies. It covers the full lifecycle from target identification (parsers, network protocols, kernels) to tool selection (AFL++, libFuzzer, Honggfuzz, syzkaller), building harnesses, curating seed corpora, executing fuzz campaigns, and finally, performing crash triage and vulnerability analysis. Essential for security researchers and embedded systems developers.

A comprehensive checklist designed for assessing the security posture of GraphQL endpoints. It covers advanced vulnerabilities such as introspection abuse, IDOR, query depth/complexity DoS, injection attacks (SQLi/NoSQLi), and authorization bypass mechanisms. Essential for professional penetration testing and bug bounty hunting.

This comprehensive checklist guides penetration testers through discovering Insecure Direct Object References (IDOR). It covers techniques like object ID enumeration, horizontal and vertical privilege escalation, and parameter manipulation. Use it for web application pentests and bug bounty hunting to identify broken access control vulnerabilities.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A comprehensive reference and bypass catalog covering modern operating system kernel mitigations such as KASLR, SMAP, SMEP, KPTI, DEP/NX, and CFI. It details how these security mechanisms function, how to detect their presence, and advanced bypass techniques (e.g., side-channel attacks, ROP chains, information leaks). This skill is essential for security professionals conducting deep penetration testing, exploit development, and target hardening assessments.

This comprehensive checklist guides users through identifying and exploiting open redirect vulnerabilities in web applications. It covers parameter identification, advanced bypass techniques (e.g., URL encoding, CRLF injection), and chaining the vulnerability with other flaws like OAuth or SSRF. Ideal for web application penetration testing and bug bounty hunting.

This skill provides a comprehensive operational checklist for identifying and exploiting HTTP Parameter Pollution (HPP) vulnerabilities. It details how various web technologies (ASP.NET, PHP, Python, etc.) handle duplicate parameters differently (e.g., first-wins, last-wins, concatenation). Use this skill during penetration testing to discover flaws in parameter parsing, which can lead to bypassing WAFs, performing logic manipulation, or achieving unauthorized access.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A deep-dive curriculum into core memory corruption vulnerability classes, covering topics like stack/heap buffer overflows, Use-After-Free (UAF), integer overflows, and format strings. This guide uses real-world CVE case studies (e.g., QNAP, Chrome) to illustrate attack vectors, impact analysis, and modern mitigation techniques. Ideal for cybersecurity professionals, penetration testers, and students learning exploit development.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

This skill provides comprehensive functionality for provisioning, managing, and scaling Oracle Cloud Infrastructure (OCI) compute instances using the Python SDK. It addresses common challenges like "out of host capacity" errors by implementing robust retry logic across multiple Availability Domains (ADs). Users can select optimal Flex shapes (AMD, ARM, Intel), manage the entire instance lifecycle (start, stop, reboot, terminate), and retrieve network details, ensuring reliable cloud workload deployment.