Skill UI

Provides step-by-step API fuzzing and exploitation tactics for REST, SOAP, and GraphQL during bug bounty or penetration tests, covering reconnaissance, auth bypass, IDOR, injection, and GraphQL-specific attacks.

Guides bug bounty hunters through API fuzzing and penetration testing, covering REST, SOAP, and GraphQL recon, authentication bypass, IDOR methods, injections, method abuse, GraphQL attacks, and payload delivery techniques.

Atheris is a coverage-guided Python fuzzer built on libFuzzer for fuzzing pure Python code and C extensions, with AddressSanitizer support to catch memory corruption and an easy harness setup for command-line fuzz runs.

Atheris is a coverage-guided Python fuzzer built on libFuzzer for fuzzing pure Python code and C extensions, with AddressSanitizer support to catch memory corruption and an easy harness setup for command-line fuzz runs.

Analyzes code coverage during fuzzing campaigns to assess harness quality, spot blockers like magic values, and guide instrumentation or corpus updates.

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

Fuzzing Dictionary supplies domain-specific tokens to guide fuzzers when targeting parsers, protocols, configs, or file formats so they reach deeper logic; include magic bytes, headers, keywords, and combine generation from LLMs, headers, or binaries before passing via the fuzzer flag.

Technique for bypassing checksums, PRNGs, and global-state guards during fuzzing by conditionally compiling test-only patches so the fuzzer can explore deeper code while production behavior stays unchanged.

This skill simulates a senior Go developer, specializing in writing high-performance, production-grade Go applications. It covers advanced topics like concurrent programming using goroutines and channels, designing robust microservices with gRPC/REST, and optimizing code using pprof and benchmarks. It enforces idiomatic Go patterns, context propagation, and strict testing practices (table-driven, fuzzing, race detection).

Guides developers in crafting and refining fuzzing harnesses that parse random fuzzer input, validate data, and exercise targeted API paths to improve coverage and find reproducible bugs.