Skill UI

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

This advanced skill details dual-use security techniques for analyzing protected binaries, conducting malware analysis, and performing authorized penetration testing. It strictly mandates that users confirm explicit written authorization, adhere to defined scope, and ensure legal compliance (e.g., CFAA, DMCA). Use cases include CTF competitions, academic research, and internal security auditing, emphasizing defensive recommendations and evidence preservation.

A specialized workflow guide for comprehensive security testing of REST and GraphQL APIs. It systematically covers critical security aspects such as authentication validation (OAuth2, JWT), authorization checks (IDOR, privilege escalation), input validation (SQL/NoSQL injection), rate limiting enforcement, and secure error handling. Ideal for vulnerability assessment, bug bounty programs, and pre-deployment security audits.

Automates vulnerability scans for applications and APIs via the security-test-scanner plugin, covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, and authorization weaknesses while generating detailed remediation reports.

Guides comprehensive API security testing for REST, GraphQL, and gRPC services using the OWASP API Security Top 10, combining Burp Suite, Postman, and custom scripts to validate authentication, authorization, rate limiting, input validation, and business logic defenses.

Automates testing APIs for Broken Function Level Authorization by mapping admin endpoints, manipulating HTTP methods, and validating access controls to expose privilege escalation risks.

Uses Postman to build reusable security test collections covering OWASP API Security Top 10, automates authentication/authorization checks, integrates Newman for CI/CD runs, and proxies traffic through OWASP ZAP to catch injection and data exposure issues.

Walks testers through intercepting REST/GraphQL API calls, identifying object ID parameters, and swapping them with other users’ identifiers to confirm OWASP API1:BOLA protections in multi-tenant services.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Secures mobile application APIs by exercising authentication flows, JWT/OAuth/OIDC defenses, token misuse, broken object-level authorization, and session management to expose vulnerabilities during penetration testing.

Evaluates OAuth 2.0 and OpenID Connect deployments for redirect URI flaws, CSRF via missing state, PKCE bypasses, token leakage, and scope escalation to ensure secure authorization-code flows before production onboarding.

A comprehensive checklist designed for assessing the security posture of GraphQL endpoints. It covers advanced vulnerabilities such as introspection abuse, IDOR, query depth/complexity DoS, injection attacks (SQLi/NoSQLi), and authorization bypass mechanisms. Essential for professional penetration testing and bug bounty hunting.