Skill UI

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Common tools include Burp Suite and Hydra. It is used for security assessments to prevent account takeover and unauthorized access.

Execute comprehensive web application security testing with Burp Suite, covering HTTP interception, request modification, Repeater, scope filtering, and vulnerability scanning for authorized assessments.

Perform dynamic application security testing against running web apps using OWASP ZAP, Burp Suite, Nikto, Nuclei, and Arachni. Automate baseline, full, and API scans in CI/CD to find runtime vulnerabilities.

Master Django 5.x framework for building scalable web applications. This skill covers async views, Django REST Framework, Celery, and Django Channels. It includes best practices for architecture, testing, security, database optimization, and deployment. Suitable for enterprise-level development requiring high performance and maintainability.

This skill provides guidance and patterns for performing web fuzzing using the ffuf tool. It helps identify potential vulnerabilities and test web applications by sending crafted requests. Suitable for security testing and development validation.

Identify and exploit file path traversal vulnerabilities to read arbitrary server files. Used in security assessments to test web application security against directory traversal attacks.

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

This skill helps identify CAPTCHA bypass vulnerabilities in web applications by testing various patterns such as omitting the CAPTCHA field, sending empty values, replaying tokens, and testing alternate endpoints. It is intended for authorized security assessments only.

This skill helps security researchers identify HTML injection vulnerabilities in web applications. It provides techniques for detecting unescaped user input, escalating to XSS, and proving impact with unique canaries. Recommended for authorized penetration testing and bug bounty engagements.

A specialized security skill for identifying and exploiting race condition vulnerabilities in web applications. Focuses on synchronized request attacks, double-spending, and bypassing access controls. Requires explicit authorization and defensive guidance protocols before execution.

Extract backend API routes from SPA JavaScript bundles to identify missing authentication or broken access control vulnerabilities. Test endpoints without credentials to find unauthenticated data exposure and security gaps in web applications.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.