Skill UI

This guide details how to configure and execute deep, authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM). By utilizing valid credentials (SSH, SMB, or ESXi), users can log into target systems to detect local vulnerabilities, missing security patches, and misconfigurations, which are typically missed by unauthenticated scans. Essential for professional security auditing and penetration testing.

Provides a workflow for authorized penetration testing across AWS, Azure, and GCP to discover IAM, storage, serverless, and compute weaknesses, leveraging Pacu, ScoutSuite, Prowler, and cloud-native tools.

A comprehensive guide for web security professionals detailing advanced techniques to bypass Content-Security-Policy (CSP) headers. It covers exploiting weaknesses such as unsafe-inline/unsafe-eval, JSONP endpoints, base-uri, and nonce/hash gaps. Used during penetration testing or bug bounty hunting to achieve Cross-Site Scripting (XSS) or data exfiltration even when CSP is implemented.

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

A specialized tool for authorized penetration testing and security assessments. It exploits the vulnerability of JWT libraries that accept tokens with the "alg": "none" header, bypassing cryptographic signature verification. Users can craft tokens with arbitrary claims (e.g., elevated privileges, impersonation) to validate that a target server correctly rejects unsigned JSON Web Tokens.

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

This comprehensive guide details the process of capturing WPA/WPA2 handshakes and performing offline dictionary and brute-force password cracking. It utilizes industry-standard tools like aircrack-ng and hashcat to assess the strength of wireless network security during authorized penetration tests. It covers everything from interface preparation to final report generation.

This skill is designed for assessing the security of Android inter-process communication (IPC) by systematically testing intents, broadcast receivers, content providers, and exported components. It helps identify critical vulnerabilities such as intent injection, unauthorized data leakage, and component hijacking, which are crucial during mobile penetration testing and security audits.

A comprehensive guide for systematically assessing modern API endpoints (REST, GraphQL, gRPC) against the OWASP API Security Top 10 (2023). This workflow covers identifying endpoints, testing for Broken Object Level Authorization (BOLA/IDOR), assessing broken authentication, and validating rate limiting. Use this during authorized penetration tests or before production deployment to ensure robust API security.