Skill UI

This skill guides the comprehensive process of crash triage, enabling the assessment of vulnerability exploitability. It covers advanced techniques using debuggers (WinDbg/GDB), sanitizers (ASAN/MSAN), and interpreting low-level data like stack traces and register dumps. It is essential for vulnerability researchers analyzing crash dumps or fuzzer-generated failures to identify root causes and potential attack vectors.

This is a detailed offensive checklist for identifying and exploiting insecure deserialization vulnerabilities across multiple programming languages (Java, Python, PHP, .NET, Node.js, etc.). It covers techniques like gadget chain generation, magic method abuse, type confusion, and modern attack vectors, providing a deep methodology for penetration testing and vulnerability research.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A deep-dive curriculum into core memory corruption vulnerability classes, covering topics like stack/heap buffer overflows, Use-After-Free (UAF), integer overflows, and format strings. This guide uses real-world CVE case studies (e.g., QNAP, Chrome) to illustrate attack vectors, impact analysis, and modern mitigation techniques. Ideal for cybersecurity professionals, penetration testers, and students learning exploit development.

A comprehensive guide for diagnosing and reducing high memory consumption in Qdrant. This resource is crucial when dealing with reports of 'memory leak', 'out of memory', or excessive RAM growth. It details how Qdrant manages resident memory and OS page cache, and provides advanced techniques such as quantization, using float16/int8 data types, and strategically storing components on disk (like HNSW indexes or sparse vectors) to minimize the memory footprint and ensure stable, scalable operation.

This mechanism is designed to optimize Qdrant's performance when handling queries with very large limits or when paginating results across multiple shards. Instead of forcing every shard to transfer the full requested limit (which is bandwidth-intensive), it uses Poisson distribution statistics to calculate smaller, optimized limits for each shard. This significantly reduces inter-shard data transfer and improves the efficiency of large-scale vector search, while maintaining a very high degree of accuracy.

This comprehensive guide details advanced strategies for managing time-series data and data retention in vector databases (like Qdrant). It is designed for scenarios where only recent data is relevant (e.g., social media feeds, news articles). Three core methods are presented: Shard Rotation (recommended for natural time boundaries), Collection Rotation (for per-period configuration needs), and Filter-and-Delete (for simple cleanup). The guide also covers hot/cold tiering to optimize performance.

This guide details the process of deploying and configuring the WizTelemetry Data Pipeline using Vector. It is essential for establishing data collection, transformation, and routing capabilities for comprehensive observability data, including logs, auditing records, events, and notifications within a Kubernetes environment.

This skill performs a proactive, comprehensive audit to quantify the business and regulatory impact of a potential data breach before it occurs. It inventories sensitive data (PII, PHI, PCI-DSS), traces complex data flows through the codebase, identifies all exposure vectors, and calculates the 'blast radius.' The output provides law-sourced figures (e.g., GDPR, CCPA, HIPAA fine maximums) alongside heuristic risk estimates, guiding proactive hardening roadmaps for compliance and security.

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.