Skill UI

This skill provides a comprehensive guide to systematic dark web monitoring, involving scanning underground forums, paste sites, and marketplaces for organizational threats. It covers setting up Tor-based crawling, automating credential leak detection (e.g., HIBP integration), and analyzing threat intelligence (CTI) using Python. Essential for proactive incident response and security auditing.

This tool provides a structured methodology for triaging web application security findings generated by DAST and SAST scanners (e.g., Burp Suite, ZAP). It validates true positives, dismisses false positives, and assigns risk ratings using the OWASP Risk Rating Methodology (Risk = Likelihood x Impact). Use it to reduce alert fatigue and prioritize remediation efforts for development teams, ensuring focus on the most critical vulnerabilities.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

A comprehensive guide for manually assessing critical business rules and workflows in web applications. This technique goes beyond automated scanning by simulating attacks like price manipulation, multi-step process bypass, and privilege escalation. Ideal for securing e-commerce checkout funnels, financial transactions, and complex authorization systems.

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A detailed methodology for identifying Cross-Site Scripting (XSS) vulnerabilities across web applications. It guides systematic testing for Reflected, Stored, and DOM-based XSS, covering payload bypass, output encoding evaluation, and assessing Content Security Policy (CSP) protection. Essential for OWASP WSTG testing and client-side security audits.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.

A comprehensive guide and code suite for performing penetration testing on real-time WebSocket APIs (WS/WSS). This tool assesses vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), missing handshake authentication, message injection, input validation failures, and DoS risks. It guides users through analyzing the handshake process and testing authorization enforcement using Python and specialized tools.