Skill UI

This skill guides security testers in identifying excessive data exposure in REST and GraphQL APIs. It involves intercepting API responses and analyzing them for leaked Personally Identifiable Information (PII), internal identifiers, or sensitive business data that the client UI does not display but the API transmits. It maps directly to OWASP API3:2023 Broken Object Property Level Authorization, helping prevent data leaks via over-fetching.

This comprehensive guide details the methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities. It teaches users how to systematically test broken access control in modern web applications and APIs. By manipulating predictable object identifiers (such as user IDs, order numbers, or document slugs), testers can validate if object-level authorization is properly enforced, preventing unauthorized horizontal or vertical data access.

This comprehensive guide outlines methods to identify and exploit specific IPv6 vulnerabilities, including SLAAC spoofing, Router Advertisement (RA) manipulation, and Neighbor Discovery Protocol (NDP) attacks. It is designed strictly for authorized penetration testing to assess dual-stack security controls, detect unauthorized tunnels (like Teredo or 6to4), and validate network defenses against IPv6-specific threats. Always obtain explicit written authorization before use.

A detailed guide on discovering and exploiting Mass Assignment vulnerabilities in REST APIs. Users learn to inject unexpected parameters into API requests (POST, PUT, PATCH) to bypass authorization controls, escalate privileges (e.g., changing 'role'), and modify sensitive fields (e.g., 'balance', 'isAdmin') during security assessments and bug bounty hunting.

A comprehensive guide for penetration testers detailing methods to identify and exploit misconfigurations in OAuth 2.0 and OpenID Connect (OIDC) flows. Techniques cover redirect URI manipulation, authorization code theft, token leakage via headers, and scope escalation during security assessments.

A comprehensive skill for detecting and exploiting JavaScript prototype pollution vulnerabilities in both client-side and server-side applications. It demonstrates advanced property injection techniques to achieve critical security outcomes, including Cross-Site Scripting (XSS), Remote Code Execution (RCE), and authentication/authorization bypass, especially in Node.js environments and JSON merging scenarios.

This guide details the process of implementing BGP route origin validation using Resource Public Key Infrastructure (RPKI). Learn how to create Route Origin Authorizations (ROAs), deploy RPKI validators, and configure Route Origin Validation (ROV) on major routers like Cisco IOS-XE and Juniper Junos. This technique is crucial for preventing malicious route hijacking and securing internet routing paths.

Binary Authorization is a critical Google Cloud security control that enforces policy-based deployment rules. It mandates that only container images with valid cryptographic attestations (proof of successful vulnerability scanning, code reviews, etc.) can be deployed to GKE or Cloud Run. Use this guide to establish robust supply chain security and compliance controls for your cloud-native applications.

This skill provides comprehensive knowledge on using JSON Web Tokens (JWT) for secure authentication and authorization. It covers implementing various cryptographic signing algorithms (such as HS256, RS256, ES256, and EdDSA), validating signatures, enforcing claim constraints (like expiration time), and implementing robust defenses against common JWT vulnerabilities, including algorithm confusion and the 'none' algorithm attack. Ideal for building secure, scalable web APIs.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.