Skill UI

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

This skill helps identify and exploit specific vulnerabilities in Node.js applications. It covers techniques like prototype pollution, Express trust proxy abuse, and template engine SSTI. Users must have explicit authorization before testing. It includes fingerprinting, detection, and exploitation chains for critical security issues.