Skill UI

A comprehensive playbook detailing identification and bypass techniques for major binary protections, including ASLR, PIE, NX/DEP, RELRO, and stack canaries. This guide is essential for understanding how to exploit modern, difficult-to-break systems in advanced security research and CTF competitions.

A comprehensive guide covering expert techniques for breaking out of container isolation. This playbook details methods for exploiting privileged modes, abusing cgroups, manipulating namespaces, and leveraging vulnerabilities in Docker or Kubernetes environments. Essential for advanced security research and penetration testing.

An expert playbook detailing DNS rebinding techniques to bypass the Same-Origin Policy (SOP). This method is used in penetration testing to exploit client-side applications that rely on DNS resolution for origin checks, allowing attackers to trick the browser into sending requests to internal, non-publicly accessible services (like cloud metadata endpoints) while maintaining a seemingly trusted origin.

This advanced playbook details expert techniques for format string exploitation. It covers arbitrary stack reading (%p), memory writing (%n), and exploiting weaknesses like GOT/hook overwrites. Essential for CTF challenges and binary vulnerability analysis to achieve reliable Remote Code Execution (RCE).

A comprehensive playbook detailing how web applications can be vulnerable to attacks by manipulating the HTTP Host header. Covers critical techniques such as password reset poisoning, Web Cache Poisoning, Server-Side Request Forgery (SSRF), and Virtual Host bypass. Essential reading for penetration testers and security researchers.

This expert playbook details advanced attack vectors specific to the HTTP/2 protocol. It covers sophisticated techniques such as h2c smuggling, exploiting pseudo-header discrepancies, HPACK compression vulnerabilities, and abusing stream multiplexing. Use this skill for professional penetration testing and security auditing of H2 services, especially for bypassing proxy-level controls and WAFs.

A comprehensive playbook for advanced mobile security assessments of iOS applications. Covers both jailbroken and non-jailbroken environments, focusing on critical attack vectors such as keychain extraction, URL scheme hijacking, Universal Links exploitation via AASA misconfigurations, runtime memory manipulation (Frida/Objection), and binary protection analysis.

A comprehensive playbook detailing advanced techniques for attacking Kubernetes clusters. Covers API server access, RBAC privilege escalation, service account token abuse, etcd secrets extraction, Kubelet exploitation, and various container escapes. This guide is essential for security professionals and red teams performing deep security assessments on cloud-native infrastructure.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

An expert-level playbook detailing advanced techniques for NTLM relay and authentication coercion. Covers cross-protocol attacks targeting SMB, LDAP, HTTP, and MSSQL. Includes methods like LLMNR poisoning, PetitPotam, and advanced domain privilege escalation to bypass standard authentication controls.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.