Skill UI

Checklist covering Spring Security best practices for authentication, authorization, validation, CSRF, secrets, headers, rate limiting, dependency scans, and logging in Java Spring Boot services.

Analyzes CORS configurations via the cors-policy-validator plugin to spot misconfigurations, validate headers or files, and report vulnerabilities so developers can secure web apps and APIs from unsafe cross-origin access.

A comprehensive guide to optimizing Vercel deployment performance. This skill covers advanced techniques such as edge caching implementation (using Cache-Control headers), leveraging Incremental Static Regeneration (ISR), minimizing serverless function cold starts, and optimizing bundle size. Use this when facing slow page load times, needing to improve Core Web Vitals, or requiring robust, scalable deployment performance.

This skill guides users through implementing comprehensive security measures for Vercel deployments. It covers best practices for secret management (using sensitive environment variables), configuring critical HTTP security headers (such as CSP and HSTS), protecting preview environments, and enforcing robust access control for API routes and deployment tokens.

This skill provides a comprehensive guide to implementing robust API versioning strategies, supporting methods like URL path, custom headers, and query parameters. It covers building backward compatibility layers, adding standard deprecation notices (e.g., Sunset Header), and utilizing OpenAPI specifications to detect breaking changes, ensuring stable API evolution over time.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.

A comprehensive guide and toolkit for identifying, repairing, and unpacking UPX-packed malware samples. It addresses scenarios where standard automated decompression fails due to modified PE headers or magic bytes, allowing analysts to recover the original executable for deep static analysis and disassembly in tools like Ghidra or IDA.

Analyze email headers to uncover sender origins, routing chains, and authentication results, enabling defenders to validate legitimacy and spot phishing indicators using manual inspection and automation scripts.

A comprehensive tool for testing API parameters, headers, and request bodies against various injection flaws, including SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF. It assesses input validation and security posture according to OWASP guidelines. Use only for authorized penetration testing.

A comprehensive guide for penetration testers detailing methods to identify and exploit misconfigurations in OAuth 2.0 and OpenID Connect (OIDC) flows. Techniques cover redirect URI manipulation, authorization code theft, token leakage via headers, and scope escalation during security assessments.

A comprehensive security assessment guide and script to test API rate limit vulnerabilities. It evaluates if an API's security controls can be bypassed using advanced techniques such as IP spoofing (manipulating X-Forwarded-For headers), HTTP method variations, and endpoint path traversal. Designed for penetration testing, it helps assess resilience against brute-force or resource exhaustion attacks, aligning with OWASP API Top 10 findings.

A comprehensive guide for web security professionals detailing advanced techniques to bypass Content-Security-Policy (CSP) headers. It covers exploiting weaknesses such as unsafe-inline/unsafe-eval, JSONP endpoints, base-uri, and nonce/hash gaps. Used during penetration testing or bug bounty hunting to achieve Cross-Site Scripting (XSS) or data exfiltration even when CSP is implemented.