Skill UI

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

This playbook provides advanced techniques for symbolic execution using angr, Z3, and Unicorn Engine. It covers automating CTF challenges, handling constraint solving patterns, function hooking, memory manipulation, and emulating custom virtual machines for binary analysis and key recovery.

This playbook provides expert-level techniques for cryptanalysis of symmetric encryption. It details how to exploit weaknesses in various modes and algorithms, including CBC padding oracle attacks, ECB mode exploitation, bit flipping attacks, stream cipher key reuse, and meet-in-the-middle attacks. Essential for authorized penetration testing and CTF challenges.

A comprehensive guide to exploiting PHP's loose type checking (using '==') and type juggling mechanics. This skill is crucial for bypassing security controls like authentication checks, HMAC/signature validations, and token comparisons that fail to use strictly typed comparisons (===) or timing-safe functions (hash_equals). Includes techniques for magic hash collisions and PHP version delta analysis.

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.

This playbook provides expert techniques for reverse engineering custom virtual machines and proprietary bytecode. It guides users through identifying dispatchers (switch/table), mapping unknown opcodes, reconstructing custom ISAs, and writing dedicated disassemblers. Essential for solving complex CTF challenges, analyzing protected software, or tackling custom runtime environments.

A comprehensive playbook detailing expert-level techniques for exploiting web cache vulnerabilities. Covers both Web Cache Deception (stealing authenticated user data) and Web Cache Poisoning (injecting malicious content). Techniques include path confusion, unkeyed header manipulation (X-Forwarded-Host), and exploiting CDN/reverse proxy caching logic. Essential reading for penetration testers and security researchers.

This module provides essential abstractions for managing language data within the admin panel. It includes `LanguageDto` for strongly typed data structures and `useLanguages` hook for fetching and handling language-related state and logic. Use this when developing administrative features that require language catalog management.

Provides essential database abstractions and utility classes for robust API development. This module includes components like FilterUtil, ValueFilter, and ValueFilterRegistry, allowing developers to implement standardized, efficient, and complex data querying and filtering logic across various database contexts.

This catalog provides 11 core abstractions for implementing robust mailing functionalities within the Webiny API architecture. It includes Use Cases, Repositories, and various Event Handlers (e.g., before/after send, save). Developers should use these structured patterns to ensure their mailer logic is modular, highly testable, and follows industry best practices.

The Form Model system provides a comprehensive, declarative way to build complex user forms. It supports defining various field types (Text, Number, DateTime, File, Object, etc.) using a fluent builder API. Developers can control layout, apply advanced validation (Zod), implement conditional visibility/disability rules, and handle complex data structures like nested objects and dynamic zones, making it ideal for building advanced admin interfaces.