Skill UI

A comprehensive guide for systematically assessing web applications and APIs for broken access control vulnerabilities (OWASP A01:2021). The methodology covers role-based access control (RBAC) auditing, horizontal and vertical privilege escalation, and multi-tenant data leakage using tools like Burp Suite, ffuf, and custom scripts. Essential for authorized penetration testing and security audits.

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

This guide details the operational workflow for namespace-scoped tenants within KubeSphere DevOps. It outlines how users without cluster-admin privileges can securely perform DevOps operations by strictly utilizing KubeSphere's dedicated APIs (`/kapis/`) and authenticating via OAuth tokens, ensuring strict resource isolation and access control within their designated namespace.

This comprehensive skill guides users through the entire Fluid storage extension lifecycle within KubeSphere. It allows for installing, upgrading, and uninstalling the Fluid extension, and managing various data resources. Users can generate YAML manifests for Datasets and specialized runtimes (Alluxio, JuiceFS, Thin), perform data loading/cache warming, scale operations, and troubleshoot issues using both kubectl and KubeSphere APIs.

A comprehensive guide for managing the full lifecycle of OpenKruise within the KubeSphere platform. This skill assists users with installation, upgrading, querying status (CRDs, Pods, logs), generating manifests for advanced workloads (SidecarSet, CloneSet), performing rollouts, and troubleshooting complex runtime issues like webhooks or missing configurations, utilizing both kubectl and KubeSphere APIs.

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.

This guide provides comprehensive details on the OpenPitrix application management system within KubeSphere. It covers the entire application lifecycle, including managing app repositories (Repo), uploading and versioning templates (Application/ApplicationVersion), conducting review processes, and finally deploying/upgrading applications (ApplicationRelease). Use this skill when troubleshooting App Store interactions, understanding KubeSphere's backend APIs, or managing deployed workloads.

Generates comprehensive, structured documentation for microservices or internal platforms. This skill covers service identity, architecture context, APIs, SLAs, data classification, and operational runbooks, making it ideal for developer portals, service READMEs, and internal service registries. It ensures new team members can quickly understand how to use and depend on a shared service.

This guide details using the comprehensive AADInternals PowerShell toolkit for defensive validation of Microsoft Entra ID, Azure AD, and AD FS environments. It covers unauthenticated tenant reconnaissance, acquiring access tokens for multiple Microsoft APIs, and critically, testing for federation backdoors (Golden SAML) by simulating advanced attack techniques (MITRE T1606.002). It is designed for authorized red-team assessments to map external attack surfaces and validate identity infrastructure hardening.

A comprehensive, black-box workflow designed for professional bug bounty hunting and penetration testing. It guides users through a 5-stage methodology (Intake, Recon, Enum, Hunt, Report), covering 19+ advanced attack playbooks (e.g., RCE, SQLi, XSS, SSRF). The skill integrates real-world exploit cases, structured payloads, and WAF bypass techniques for maximizing vulnerability discovery in web applications and APIs.