Skill UI

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

Comprehensive guidance on using Shodan’s web UI, CLI, and API for reconnaissance, exposed-service discovery, screenshot capture, and exporting JSON/CSV data during penetration tests.

This skill enables running Playwright tests on BrowserStack's cloud grid for cross-browser and cross-device compatibility testing. It includes configuring environment variables, setting up projects for different browsers like Chrome, Firefox, and WebKit, executing tests remotely, retrieving build results, and checking available browser combinations. It supports local testing via BrowserStack Local for firewall scenarios.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.

This skill generates a complete, opinionated, modern full-stack Rails application boilerplate. It sets up a robust tech stack including Rails 8, PostgreSQL, React, Inertia.js, Vite, Tailwind CSS, Sidekiq, and Redis. Designed for developers who need a starting point that adheres to best practices for database structure (UUIDs, JSONB), background job processing, comprehensive testing, and modern frontend development (TSX). Ideal for bootstrapping complex, production-grade web services.

A comprehensive set of architectural patterns for building robust and maintainable HTTP servers using Kotlin Coroutines and the Ktor framework. It covers essential topics including REST routing DSL, plugin configuration (Authentication, CORS, StatusPages), Dependency Injection (Koin), serialization, WebSockets, and integration testing using testApplication.

A comprehensive guide to using k6 for robust performance and load testing across APIs, WebSockets, and browser scenarios. Learn to write realistic load simulations (smoke, load, stress, soak), analyze performance metrics, set SLAs, and integrate testing into CI/CD pipelines to ensure system reliability before deployment.

AWT provides AI coding tools with the ability to perform sophisticated End-to-End (E2E) web testing using a real browser. It accepts declarative YAML scenarios and executes them via Playwright. Key features include visual matching (OpenCV + OCR) instead of relying on fragile DOM selectors, automatic platform detection (React, Vue, etc.), and structured failure diagnosis for improved AI coding workflows.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.