Download

Skill UI

Browse and discover 11126+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search ai-testing , found 340 results

Default Newest Most Downloaded

Mobile Pentest Methodology

offensive-mobile

SnailSploit/Claude-Red

A practical offensive methodology for Android and iOS app testing. It covers static analysis, Frida/Objection instrumentation, SSL pinning bypass, exported component abuse, insecure storage review, and mobile API reconnaissance for pentest and bug bounty work.

API Authentication And JWT Abuse Testing

api-auth-and-jwt-abuse

yaklang/hack-skills

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

API Reconnaissance and Documentation Review

api-recon-and-docs

yaklang/hack-skills

A comprehensive playbook for API reconnaissance and documentation review. Use this skill early in the testing process to enumerate all reachable endpoints, extract schemas, identify hidden versions (e.g., v1, v2, mobile), and discover undocumented parameters or fields across REST, GraphQL, and mobile APIs. Essential for mapping the full attack surface before deeper exploitation.

Advanced Content Security Policy Bypass Techniques

csp-bypass-advanced

yaklang/hack-skills

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

CSV and Spreadsheet Formula Injection Testing

csv-formula-injection

yaklang/hack-skills

This skill details advanced techniques for exploiting formula injection vulnerabilities within CSV, Excel, LibreOffice, and Google Sheets environments. It covers DDE, obfuscation methods, and high-risk functions like IMPORT* that can be triggered when user-controlled data is exported or imported into spreadsheet software. Use this for penetration testing of data pipelines and export features.

Advanced Email Header Injection And Spoofing

email-header-injection

yaklang/hack-skills

This expert playbook covers advanced techniques for email header injection and authentication bypass. It details exploiting CRLF vulnerabilities in SMTP headers (e.g., BCC/CC injection, body control) and bypassing modern email security standards like SPF, DKIM, and DMARC. Essential for penetration testing of contact forms, email APIs, and password reset workflows.

File Access and Upload Vulnerability Router

file-access-vuln

yaklang/hack-skills

This router entry point is designed for comprehensive testing of file access, download endpoints, and file upload workflows. Use this guide when validating file paths, detecting Local File Inclusion (LFI), or analyzing vulnerabilities in preview, storage, or extraction processes. It helps categorize whether the security issue relates to path traversal or insecure data processing chains.

GraphQL And Undocumented Parameter Testing

graphql-and-hidden-parameters

yaklang/hack-skills

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

Injection Testing Router Guide

injection-checking

yaklang/hack-skills

This router serves as the main entry point for comprehensive injection testing. It helps security professionals classify dangerous input flows—such as XSS, SQLi, SSRF, XXE, etc.—by determining the final sink or interpreter (e.g., browser context, database, XML parser, shell). Use it when unsure which specific injection vector to prioritize.

JNDI Injection Vulnerability Exploitation

yaklang/hack-skills

A comprehensive playbook detailing advanced JNDI injection techniques. Covers the abuse of JNDI lookups via RMI and LDAP, focusing on critical vulnerabilities like Log4Shell (CVE-2021-44228), deserialization gadgets, and post-8u191 bypass methods. Essential for deep-dive security testing and vulnerability research.

JWT and OAuth Token Attacks Playbook

jwt-oauth-token-attacks

yaklang/hack-skills

An expert playbook detailing advanced attacks against JWT and OAuth 2.0 tokens. Covers cryptographic weaknesses like alg:none, key confusion (RS256 to HS256), and header injection (kid, jku). It also addresses critical OAuth flow abuses, such as missing state parameters, account takeover, and token leakage, essential for robust application security testing.

macOS Security Bypass Techniques Playbook

macos-security-bypass

yaklang/hack-skills

A comprehensive playbook detailing advanced techniques for bypassing core macOS security features, including TCC, Gatekeeper, SIP, and sandbox restrictions. This guide is essential for authorized red team operations and penetration testing targeting macOS endpoints, covering methods like direct database manipulation, extended attribute removal, and privilege escalation paths.

Prev 1 2 3...21 22 232425 26 27 28 29 Next

Language