Skill UI

A comprehensive set of architectural patterns for building robust and maintainable HTTP servers using Kotlin Coroutines and the Ktor framework. It covers essential topics including REST routing DSL, plugin configuration (Authentication, CORS, StatusPages), Dependency Injection (Koin), serialization, WebSockets, and integration testing using testApplication.

Deploy RASP agents for Java and Python web apps to detect and block OWASP Top 10 attacks from inside the runtime, tune detection policies, baseline behavior, and forward telemetry to SIEM for comprehensive audit and response.

This skill is designed for implementing and managing user verification workflows within a Laravel PHP framework. It facilitates processes such as email confirmation, password reset validation, and ensuring data integrity for secure application access. It is essential for robust web backend development.

Techniques for bypassing Web Application Firewalls using encoding, HTTP tricks, payload splitting, and SQLMap tamper scripts to deliver SQLi and XSS payloads during penetration tests and red-team engagements.

Guides systematic OWASP WSTG web app penetration tests using Burp Suite plus manual techniques to uncover authentication, authorization, input validation, session, and business logic vulnerabilities for compliance and preproduction assurance.

Step-by-step Nikto guidance covering basic and advanced scans, tuning options, report exports, and integrations so security teams can validate web servers, SSL settings, and CVEs during vulnerability assessments.

This tool provides a structured methodology for triaging raw vulnerability findings generated by DAST and SAST scanners. It utilizes the OWASP risk rating methodology to validate true positives, filter out false positives, and calculate a comprehensive risk score (Risk = Likelihood x Impact). This process significantly reduces alert fatigue and ensures development teams prioritize remediation efforts on the most critical and exploitable vulnerabilities.

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

Systematically test web applications for broken access control by mapping endpoints, configuring Burp Authorize, and exercising vertical/horizontal privilege escalation via API requests to surface unauthorized behaviors during penetration tests.

Manual penetration testing focused on business logic vulnerabilities in web applications, covering price manipulation, workflow bypasses, privilege escalation, and race conditions when automated scanners miss critical flaws.

This guide details how to test web applications and APIs that send emails for Email Header Injection vulnerabilities. It covers techniques like CRLF injection to manipulate email headers (e.g., adding unauthorized CC/BCC fields, modifying the sender 'From' address, or overriding the content type). Use cases include auditing contact forms, password reset features, and general email endpoints to prevent spam relay, spoofing, and data interception.

Guides penetration testers through systematic host header injection checks, covering password reset poisoning, cache poisoning, SSRF, virtual host routing, and connection-state attacks for web applications.