Download

Skill UI

Browse and discover 15857+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Web Testing , found 141 results

Default Newest Most Downloaded

Exploiting PHP Type Juggling Vulnerabilities

exploiting-type-juggling-vulnerabilities

mukul975/Anthropic-Cybersecurity-Skills

This skill details techniques for exploiting PHP's type juggling vulnerabilities, primarily caused by loose (==) comparison operators. It demonstrates how attackers can bypass authentication mechanisms, defeat magic hash function verifications, and manipulate application logic through controlled type coercion when testing web applications. Ideal for authorized security penetration testing.

Testing WebSocket Security Vulnerabilities

exploiting-websocket-vulnerabilities

mukul975/Anthropic-Cybersecurity-Skills

This comprehensive guide outlines techniques for authorized penetration testing of real-time web applications using WebSocket connections. It covers discovering various WebSocket endpoints, testing for authentication bypass, identifying Cross-Site WebSocket Hijacking (CSWSH) vulnerabilities, and assessing message handling for injection flaws (SQLi, XSS). Essential for securing chat, trading, and live notification platforms.

Integrating DAST with OWASP ZAP Pipeline

integrating-dast-with-owasp-zap-in-pipeline

mukul975/Anthropic-Cybersecurity-Skills

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.

Testing for Clickjacking Vulnerabilities

performing-clickjacking-attack-test

mukul975/Anthropic-Cybersecurity-Skills

This skill guides authorized security professionals through testing web applications for clickjacking vulnerabilities. It involves checking frame embedding controls (like X-Frame-Options and CSP) and crafting complex proof-of-concept overlays to see if users can be tricked into performing unintended sensitive actions, such as deleting accounts or transferring funds.

CSP Bypass Techniques and Exploitation

performing-content-security-policy-bypass

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide for web security professionals detailing advanced techniques to bypass Content-Security-Policy (CSP) headers. It covers exploiting weaknesses such as unsafe-inline/unsafe-eval, JSONP endpoints, base-uri, and nonce/hash gaps. Used during penetration testing or bug bounty hunting to achieve Cross-Site Scripting (XSS) or data exfiltration even when CSP is implemented.

Performing JWT None Algorithm Attack

performing-jwt-none-algorithm-attack

mukul975/Anthropic-Cybersecurity-Skills

A specialized tool for authorized penetration testing and security assessments. It exploits the vulnerability of JWT libraries that accept tokens with the "alg": "none" header, bypassing cryptographic signature verification. Users can craft tokens with arbitrary claims (e.g., elevated privileges, impersonation) to validate that a target server correctly rejects unsigned JSON Web Tokens.

SOAP Web Service Security Tester

performing-soap-web-service-security-testing

mukul975/Anthropic-Cybersecurity-Skills

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

SSRF Vulnerability Exploitation Tool

performing-ssrf-vulnerability-exploitation

mukul975/Anthropic-Cybersecurity-Skills

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.

Web Cache Poisoning Attack Techniques

performing-web-cache-poisoning-attack

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

Testing CORS Misconfiguration for Security Assessment

testing-cors-misconfiguration

mukul975/Anthropic-Cybersecurity-Skills

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

Business Logic Vulnerability Testing Guide

testing-for-business-logic-vulnerabilities

mukul975/Anthropic-Cybersecurity-Skills

A comprehensive guide for manually assessing critical business rules and workflows in web applications. This technique goes beyond automated scanning by simulating attacks like price manipulation, multi-step process bypass, and privilege escalation. Ideal for securing e-commerce checkout funnels, financial transactions, and complex authorization systems.

Testing Email Header Injection Vulnerabilities

testing-for-email-header-injection

mukul975/Anthropic-Cybersecurity-Skills

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

Prev 1 2 3 4 567 8 9 10 11 12 Next

Language