Skill UI

This skill details how to execute HTTP Parameter Pollution (HPP) attacks. HPP exploits differences in how web applications and Web Application Firewalls (WAFs) process duplicate parameters within a single request (e.g., query strings or POST bodies). It is crucial for penetration testing to bypass input validation, WAF rules, and uncover parameter parsing inconsistencies in APIs and web forms.

A specialized tool for authorized penetration testing and security assessments. It exploits the vulnerability of JWT libraries that accept tokens with the "alg": "none" header, bypassing cryptographic signature verification. Users can craft tokens with arbitrary claims (e.g., elevated privileges, impersonation) to validate that a target server correctly rejects unsigned JSON Web Tokens.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

A comprehensive guide for authorized red team engagements, detailing manual enumeration and automated tooling to escalate privileges from a low-level user to root on Linux. Techniques cover exploiting misconfigurations, vulnerable services, kernel flaws, and weak permissions, mapped directly to MITRE ATT&CK framework. Use only in controlled, authorized security testing environments.

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

Simulates man-in-the-middle (MITM) attacks by stripping SSL/TLS encryption, forcing HTTPS connections to downgrade to insecure HTTP. This skill is designed for authorized penetration testing to validate HSTS enforcement, assess certificate validation mechanisms, and train security teams on detecting cleartext data leakage during a downgrade attack.

This skill assesses SSL/TLS server configurations using the sslyze Python library. It evaluates critical security parameters including supported protocol versions (TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, and known vulnerabilities like Heartbleed and ROBOT. Essential for security audits and compliance testing.

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

This comprehensive guide details the process of performing authenticated and unauthenticated vulnerability assessments using Tenable Nessus. It covers everything from advanced scan configuration (port discovery, credentialing, plugin setup) to detailed result analysis, including cross-referencing CVEs and prioritizing remediation based on CVSS scores and exploit availability. Ideal for compliance auditing, penetration testing, and maintaining system patch compliance.

This guide details advanced techniques for bypassing Web Application Firewalls (WAFs). It covers methods such as payload obfuscation, advanced URL encoding, HTTP method manipulation (PUT, PATCH, etc.), parameter pollution, and utilizing specialized tools like SQLMap tamper scripts to smuggle exploit payloads (e.g., SQLi, XSS) past perimeter security controls. Essential for penetration testing and red team engagements.