Skill UI

Automated guidance for cookie security analysts that covers authentication, validation, secure coding, and vulnerability detection while generating production-ready code and configurations.

Explains how to create route.ts endpoints in the Next.js App Router, covering HTTP methods, request/response handling, streaming, cookies, redirects, CORS, and caching so you can build REST APIs.

This skill scans web application endpoints and cookies to spot missing CSRF safeguards—tokens, double-submit cookies, SameSite attributes, and origin checks—then documents vulnerable paths and mitigation steps for security reviews.

A comprehensive guide for developers on handling sensitive data and ensuring compliance with major privacy regulations like GDPR and CCPA when deploying serverless functions on Vercel. Learn techniques for PII redaction in logs, implementing data subject rights (Right to Access/Erasure), securing session cookies, and configuring data residency to meet global privacy standards.

Hindsight is an open-source tool designed for digital forensics, parsing artifacts from various Chromium-based browsers (Chrome, Edge, Brave, etc.). It extracts and correlates all web activity data, including browsing history, cookies, cached content, downloads, and saved credentials, into a unified timeline. This tool is essential for incident response, insider threat investigations, and reconstructing user web activity in security and legal contexts.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

A comprehensive guide for authorized penetration testers on identifying and exploiting insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET). Covers techniques for generating payloads using tools like ysoserial and phpggc, and testing various application components such as cookies, HTTP parameters, and message queues to achieve potential Remote Code Execution (RCE).

A comprehensive guide for digital forensics and incident response, detailing methods to extract and analyze critical web activity data. This includes history, cookies, cache, downloads, and bookmarks from major browsers like Chrome, Firefox, and Edge. Techniques involve utilizing SQLite querying and specialized tools on forensic images or live systems to establish a user's digital timeline.

A comprehensive guide for authorized penetration testers on identifying and exploiting Cross-Site Request Forgery (CSRF) vulnerabilities. This skill covers analyzing state-changing requests, testing anti-CSRF token implementations, and verifying defenses like SameSite cookies and Origin/Referer header validation using tools like Burp Suite.

EvilGinx3 is an advanced Adversary-in-the-Middle (AiTM) framework designed for red teaming simulations. It goes beyond traditional credential harvesting by acting as a transparent proxy to intercept the entire authentication flow, including session cookies and Multi-Factor Authentication (MFA) tokens. This capability allows security professionals to assess the robustness of an organization's security posture against sophisticated account takeover attacks.

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

This skill scans live websites or local codebases to detect all data collection signals, including cookies, analytics, forms, and third-party processors. It then generates a comprehensive, 12-section privacy policy tailored for GDPR and CCPA compliance. The system maps detected data touchpoints to specific legal bases (Consent, Contract, etc.), ensuring the resulting policy accurately reflects the actual data practices of your application or website.