Skill UI

This module provides comprehensive connection methods for Azure Database for PostgreSQL Flexible Server using Node.js and TypeScript with the pg package. It supports both traditional password authentication and modern, recommended Microsoft Entra ID (passwordless) authentication. The guide demonstrates best practices, including connection pooling, parameterized queries to prevent SQL injection, and robust transaction management (BEGIN/COMMIT/ROLLBACK).

A comprehensive framework for penetration testing APIs, designed to detect and exploit critical injection flaws. It covers SQL injection (SQLi), NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF). This skill guides the testing of all input vectors—including path parameters, headers, query strings, and request bodies—to assess input validation and backend security posture against industry standards like OWASP.

A comprehensive guide detailing advanced techniques for bypassing Web Application Firewalls (WAFs). It covers multiple evasion methods, including various encoding schemes (URL, Unicode, HTML entities), payload obfuscation (mixed case, comments), and manipulation of HTTP protocols (methods, headers, parameter pollution). This skill is crucial for penetration testing, red team engagements, and evaluating the robustness of perimeter security controls against sophisticated attacks like SQL Injection and XSS.

This comprehensive checklist guides users through identifying and exploiting open redirect vulnerabilities in web applications. It covers parameter identification, advanced bypass techniques (e.g., URL encoding, CRLF injection), and chaining the vulnerability with other flaws like OAuth or SSRF. Ideal for web application penetration testing and bug bounty hunting.

An expert playbook detailing advanced attacks against JWT and OAuth 2.0 tokens. Covers cryptographic weaknesses like alg:none, key confusion (RS256 to HS256), and header injection (kid, jku). It also addresses critical OAuth flow abuses, such as missing state parameters, account takeover, and token leakage, essential for robust application security testing.

A comprehensive playbook detailing NoSQL injection techniques, moving beyond traditional SQLi. Covers deep vulnerabilities in MongoDB, including operator injection, login bypass, blind data extraction using regex, and $where execution. Also includes attacks specific to Redis, CouchDB, and general API parameter pollution.