Skill UI

A comprehensive skill guide for assessing JSON Web Token (JWT) security flaws. This technique covers advanced attack vectors such as algorithm confusion (e.g., RS256 to HS256), 'none' algorithm bypass, key ID (kid) injection, and JKU/X5U parameter manipulation. It also includes methods for brute-forcing weak symmetric secrets and is essential for penetration testing OAuth2/OIDC and SSO systems.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

A comprehensive security tool designed to assess the resilience of OAuth 2.0 and OpenID Connect (OIDC) implementations. It probes for critical misconfigurations and security flaws, including authorization code interception, redirect URI manipulation (open redirects), CSRF vulnerabilities, scope escalation, token leakage, and PKCE bypass. Essential for penetration testing of Single Sign-On (SSO) systems and API security.

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

A comprehensive guide for configuring and troubleshooting Jenkins when embedded within KubeSphere DevOps. Learn how to manage Jenkins via Configuration as Code (CasC), integrate advanced authentication methods like LDAP and OIDC, customize agent images, and connect to external sources such as GitLab. Covers everything from initial access to backup and recovery.

This skill provides a comprehensive guide for deploying Navan's connections to major enterprise platforms, including ERP systems (NetSuite, Xero), HRIS (Workday), and Identity Providers (Okta, Azure AD). It covers best practices for expense sync, user provisioning (SCIM), and Single Sign-On (SAML/OIDC) using APIs and admin configurations, ensuring secure and accurate data flow across disparate business systems.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

Master the setup of enterprise-grade Role-Based Access Control (RBAC) within Snowflake. This guide covers defining custom role hierarchies, managing system roles, granting granular object privileges, and integrating advanced security features like SAML/OIDC-based Single Sign-On (SSO) and SCIM for automated user provisioning. Essential for implementing least-privilege access patterns and robust data governance.

This guide details how to integrate Auth0 as an external Identity Provider (IDP) for Webiny, replacing the default Cognito authentication. It involves creating an API config class to map Auth0's JWT claims to Webiny identities and implementing a React extension component. Users must set environment variables (AUTH0_ISSUER, AUTH0_CLIENT_ID) and register the necessary extensions for successful OIDC authentication flow.

This skill guides developers on integrating Okta as an external Identity Provider (IDP) for Webiny. It replaces default authentication methods (like Cognito) by utilizing the OpenID Connect (OIDC) standard. The process involves setting up an API configuration class to map Okta's JWT claims to Webiny identities, and creating a React extension component to wire the issuer URL, client ID, and configuration path, enabling seamless Single Sign-On (SSO) using Okta.

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

A comprehensive guide detailing best practices for securing Quarkus applications. It covers robust authentication methods like JWT and OIDC, role-based access control (RBAC) for authorization, mandatory input validation using Bean Validation, preventing SQL injection, and secure secret management. Essential for developers building highly secure Java microservices.