Skill UI

This skill provides a comprehensive operational checklist for identifying and exploiting HTTP Parameter Pollution (HPP) vulnerabilities. It details how various web technologies (ASP.NET, PHP, Python, etc.) handle duplicate parameters differently (e.g., first-wins, last-wins, concatenation). Use this skill during penetration testing to discover flaws in parameter parsing, which can lead to bypassing WAFs, performing logic manipulation, or achieving unauthorized access.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

A comprehensive guide to advanced SQL injection (SQLi) methodologies for offensive security assessments and bug bounty hunting. Covers all major injection types, including error-based, boolean/time-based blind, out-of-band, and second-order injection. Provides specific payloads and techniques for MySQL, MSSQL, PostgreSQL, Oracle, and NoSQL databases, along with methods for bypassing WAFs, exploiting GraphQL, WebSocket, and modern API filters. Includes full automation workflows using tools like sqlmap.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This skill guides developers through critical breaking changes when upgrading OneNote integrations using the Microsoft Graph SDK. It details how to migrate from app-only to delegated authentication, replace decommissioned webhooks with polling, update deprecated search endpoints to OData filters, and upgrade the Graph SDK from v5 to v6. Essential for maintaining compatibility with modern Microsoft Graph APIs.

This utility addresses the lack of webhooks for OneNote resources. It implements an efficient change detection mechanism by performing timestamp-based polling and delta query comparisons against the Microsoft Graph API. It is essential for building real-time synchronization, change monitoring, or event-driven integrations for OneNote, while carefully managing API rate limits.

This guide establishes an optimized local development loop for Oracle Cloud Infrastructure (OCI). It teaches users how to bypass the slow web console by setting up dedicated CLI profiles (dev, staging, prod), managing environment variables, and creating robust shell aliases. This allows developers to perform complex operations—such as listing resources, launching instances, and managing storage—directly from the terminal, ensuring speed and consistency across all environments.

This skill guides users on building robust, event-driven pipelines within Oracle Cloud Infrastructure (OCI). It covers setting up OCI Events rules to monitor resource state changes (Compute, Object Storage, Identity). Events can then be routed to Oracle Notification Service (ONS) topics for real-time alerting or directly to OCI Functions (serverless processing) for complex, automated actions.

A secure two-way synchronization tool that bridges a local ARIS audit/editing directory with a remote Overleaf project via the Overleaf Git bridge. This allows users to perform intensive, local-only audits and processing while maintaining the ability for collaborators to edit the paper directly in the Overleaf web UI. It handles complex pull/push logic, ensuring changes are synced correctly while preserving the integrity of local audit results.