Skill UI

This skill guides authorized security professionals through testing web applications for clickjacking vulnerabilities. It involves checking frame embedding controls (like X-Frame-Options and CSP) and crafting complex proof-of-concept overlays to see if users can be tricked into performing unintended sensitive actions, such as deleting accounts or transferring funds.

This skill details advanced methodologies for bypassing Content Security Policy (CSP) protections. It covers exploiting misconfigurations, such as using 'unsafe-inline' or 'unsafe-eval', leveraging JSONP endpoints, manipulating base-uri, and leaking nonces. It is essential for web application penetration testing and security auditing when standard XSS payloads are blocked by CSP.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

This guide details the technique and workflow for executing HTTP Parameter Pollution (HPP) attacks. HPP exploits how web applications and back-end systems handle duplicate HTTP parameters (e.g., first-wins, last-wins, concatenation). It is a critical method for bypassing Web Application Firewalls (WAFs), testing input validation logic, and identifying vulnerabilities in API, OAuth, and payment processing flows.

A comprehensive guide for cybersecurity professionals detailing the process of collecting, parsing, and correlating system, application, and security logs (Windows EVTX, Linux syslog, web logs). It helps reconstruct event timelines, identify breach activity, and establish evidence for forensic reports.

A comprehensive guide detailing advanced techniques for bypassing Web Application Firewalls (WAFs). It covers multiple evasion methods, including various encoding schemes (URL, Unicode, HTML entities), payload obfuscation (mixed case, comments), and manipulation of HTTP protocols (methods, headers, parameter pollution). This skill is crucial for penetration testing, red team engagements, and evaluating the robustness of perimeter security controls against sophisticated attacks like SQL Injection and XSS.

This tool guides the process of reviewing security findings from DAST and SAST scanners. It uses the OWASP risk rating methodology to classify vulnerabilities (true positive, false positive, needs review) and calculate a comprehensive risk score based on likelihood and impact, ensuring development teams prioritize the most critical issues.

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

This skill provides a comprehensive methodology for identifying and exploiting open redirect vulnerabilities in web applications. It covers advanced bypass techniques (e.g., URL encoding, protocol-relative URLs, path traversal) and demonstrates chaining with other flaws like OAuth redirection for advanced phishing simulations and token theft. Designed for authorized security professionals conducting penetration tests.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

This comprehensive skill guides the testing of web applications for Cross-Site Scripting (XSS) vulnerabilities. It covers reflected, stored, and DOM-based injection points. Testers learn to map input/output contexts, craft context-appropriate payloads, and bypass complex sanitization and CSP protections, ensuring thorough client-side security assessment.