Skill UI

Provides quick reference to penetration testing commands for network scanning, exploitation, password cracking, and web testing workflows, helping security professionals run tools like Nmap, Metasploit, Nikto, and SQLMap during assessments.

This curriculum covers foundational exploitation techniques essential for binary security analysis. Users will learn to control program execution flow, including overwriting EIP/RIP, constructing ROP chains, implementing ret2libc, and shellcode injection. It provides practical, hands-on exercises on stack overflows and heap manipulation in a controlled Linux environment, establishing the core primitives needed before tackling modern mitigation bypasses.

This is a detailed offensive checklist for identifying and exploiting insecure deserialization vulnerabilities across multiple programming languages (Java, Python, PHP, .NET, Node.js, etc.). It covers techniques like gadget chain generation, magic method abuse, type confusion, and modern attack vectors, providing a deep methodology for penetration testing and vulnerability research.

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

A comprehensive methodology and checklist for identifying and exploiting race conditions (TOCTOU) in web applications. It guides users to find timing windows, detect vulnerabilities like double-spend or rate limit bypass, and exploit concurrent request flaws in state-changing business logic. Essential for penetration testing and bug bounty hunting.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

This skill provides a deep dive into modern Windows exploit mitigations, including ASLR, DEP/NX, CFG, and CET. It covers how these core protections work, techniques for detecting them, and advanced methodologies for analyzing bypass strategies. It is essential reading for security researchers and penetration testers planning advanced exploitation chains against modern operating systems.