Skill UI

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

This guide provides a comprehensive, advanced methodology for red team operations. It covers critical topics such as Operational Security (OPSEC), designing robust C2 infrastructure using redirectors, employing living-off-the-land techniques, mastering lateral movement, establishing persistence, and planning data exfiltration while evading modern defensive systems. Use this to plan complex red team engagements or deeply understand Advanced Persistent Threat (APT) TTPs.

A comprehensive methodology for discovering potential software vulnerabilities. It outlines advanced techniques including static analysis, dynamic analysis, fuzzing, taint tracking, and modern attack surface mapping (e.g., kernel, drivers). Ideal for professional code audits, bug bounty hunting, and building robust vulnerability research pipelines.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

This skill provides a comprehensive checklist and detailed methodology for detecting HTTP Request Smuggling vulnerabilities. It covers various desynchronization types (CL.TE, TE.CL, TE.TE), including HTTP/2 and modern variants. Use this when penetration testing multi-server architectures, proxies, or load balancers to identify potential security bypasses, unauthorized access, or cache poisoning risks.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

A comprehensive playbook detailing identification and bypass techniques for major binary protections, including ASLR, PIE, NX/DEP, RELRO, and stack canaries. This guide is essential for understanding how to exploit modern, difficult-to-break systems in advanced security research and CTF competitions.

This expert playbook details advanced techniques for exploiting stack-based vulnerabilities, including classic buffer overflows, Return-Oriented Programming (ROP), ret2libc, and specialized gadgets like ret2csu and SROP. It provides comprehensive guidance on bypassing modern memory mitigations (NX, ASLR, PIE) to hijack program control flow and achieve reliable remote code execution in userland binaries.