Skill UI

Authorized security testing skill for hunting web cache poisoning and password reset host-header injection. Maps CDN caching layers, probes unkeyed headers such as X-Forwarded-Host, and verifies cache HIT signals to confirm exploitable poisoned responses.

This skill helps identify CAPTCHA bypass vulnerabilities in web applications by testing various patterns such as omitting the CAPTCHA field, sending empty values, replaying tokens, and testing alternate endpoints. It is intended for authorized security assessments only.

This skill identifies security vulnerabilities in CI/CD pipelines, focusing on Jenkins Script Console, GitHub Actions workflows, and self-hosted runners. It covers techniques like Pwnrequest injection, credential store dumping, and Terraform state leakage. Requires explicit authorization for offensive security assessments.

This skill focuses on identifying clickjacking vulnerabilities where malicious sites overlay transparent iframes over legitimate pages to trick users into unintended actions. It involves checking security headers like X-Frame-Options and CSP, verifying if sensitive actions can be triggered via framing, and ensuring proper authorization before testing. It is strictly for authorized security assessments and bug bounty programs.

A security skill for identifying cloud and infrastructure misconfigurations such as exposed storage buckets, metadata endpoints, and admin panels. Includes techniques for S3, EC2, Jenkins, and CloudWatch RUM exploitation, requiring explicit authorization for offensive testing.

Authorized-only guide for hunting CORS misconfigurations, validating credentialed cross-origin reads with browser PoCs, and prioritizing high-impact targets.

A skill for hunting CSRF vulnerabilities in web applications. Covers raw HTTP client techniques, token bypass methods, and high-value target identification, with an emphasis on authorized testing.

Offensive security skill for hunting insecure deserialization flaws in Java, PHP, Python, .NET and Ruby. Covers ysoserial gadget chains, PHP object injection, pickle payloads, ViewState and JNDI/Log4Shell, with strict authorization gates.

This skill acts as a loader for the /hunt orchestrator, facilitating authorized security assessments. It enforces strict scope boundaries and requires explicit written authorization before execution. The tool includes baseline checks to avoid false positives and fingerprinting capabilities to identify technology stacks like Next.js or cloud providers. It focuses on generating reproducible findings for remediation rather than exploitation.

This skill enables the identification and exploitation of client-side DOM vulnerabilities, including DOM Clobbering, PostMessage bypasses, Service Worker abuse, and CSS exfiltration. It is designed for authorized security assessments to discover high-value attack chains that bypass server-side filters. Users must obtain explicit written permission before testing any target.

Technique for authorized bug-bounty and penetration-testing engagements that hunts mishandled exceptional conditions in web apps, inducing unhandled exceptions with wrong-type, malformed, or boundary inputs to detect verbose stack traces, ORM internals, server paths, and framework version leaks.

This skill provides techniques for hunting file upload vulnerabilities, including content-type bypass, extension bypass, magic bytes spoofing, SVG XSS, ImageMagick/FFmpeg SSRF, headless Chrome SSRF, and archive extraction attacks like Zip Slip. It includes prevention methods and requires explicit authorization.