Skill UI

This router entry point is designed for comprehensive testing of file access, download endpoints, and file upload workflows. Use this guide when validating file paths, detecting Local File Inclusion (LFI), or analyzing vulnerabilities in preview, storage, or extraction processes. It helps categorize whether the security issue relates to path traversal or insecure data processing chains.

A comprehensive playbook detailing advanced JNDI injection techniques. Covers the abuse of JNDI lookups via RMI and LDAP, focusing on critical vulnerabilities like Log4Shell (CVE-2021-44228), deserialization gadgets, and post-8u191 bypass methods. Essential for deep-dive security testing and vulnerability research.

This comprehensive playbook details advanced techniques for detecting Prototype Pollution vulnerabilities in JavaScript environments (Node.js and browser). It covers various attack vectors, including using `__proto__` and `constructor.prototype` paths, and provides black-box testing payloads for JSON parsing, query string merging, and deep object assignment. Use this when analyzing applications for potential Remote Code Execution (RCE) or unintended property leakage via object merging sinks.

This router serves as the initial guide for comprehensive security assessments on new targets or unknown attack surfaces. It helps users map the scope, discover hidden assets, perform detailed technology fingerprinting, build endpoint inventories, and strategically plan the optimal testing path before diving into specific vulnerability checks (e.g., API, Auth, Injection).

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.