Skill UI

A comprehensive playbook detailing advanced techniques for exploiting insecure deserialization flaws across Java, PHP, and Python. It covers traffic fingerprinting, identifying specific gadget chains (e.g., Commons Collections, Shiro), and utilizing tools like ysoserial to achieve Remote Code Execution (RCE) and privilege escalation.

A deep-dive playbook covering expert techniques for Path Traversal and Local File Inclusion (LFI). It details multiple bypass methods (encoding, null bytes, wrappers), target file enumeration on Linux and Windows, and advanced Remote Code Execution (RCE) escalation paths, such as log poisoning via PHP wrappers.

A comprehensive playbook detailing advanced techniques for establishing and maintaining remote command-line access. Covers foundational knowledge like reverse vs. bind shells, encrypted communication methods (OpenSSL, socat), web shell implementation (PHP, ASPX, JSP), PTY upgrading for interactivity, robust file transfer methods (Linux/Windows), and advanced PowerShell payloads.

A comprehensive guide to exploiting PHP's loose type checking (using '==') and type juggling mechanics. This skill is crucial for bypassing security controls like authentication checks, HMAC/signature validations, and token comparisons that fail to use strictly typed comparisons (===) or timing-safe functions (hash_equals). Includes techniques for magic hash collisions and PHP version delta analysis.

This playbook provides expert-level techniques for exploiting common infrastructure services that are exposed without proper authentication. Coverage includes Redis RCE, Rsync data theft, PHP-FPM code execution, AJP file reads, and MongoDB/Hadoop vulnerabilities. Essential for deep penetration testing and security auditing.

A comprehensive playbook for testing XSLT injection vulnerabilities. This guide details advanced attack chains, starting with processor fingerprinting (Java, PHP, .NET, libxslt). It covers critical vectors including XXE (External Entities), Server-Side Request Forgery (SSRF) via document(), arbitrary file writing (EXSLT), and achieving Remote Code Execution (RCE) through language-specific extensions.

A comprehensive reference guide detailing modern and idiomatic PHP coding standards. It covers best practices across various topics, including type safety (strict typing, union types), object-oriented programming (constructor promotion, enums, match expressions), efficient array handling, robust error handling (exceptions), and modern string manipulation functions. Ideal for developers looking to upgrade legacy PHP code to modern, clean, and performant standards.

This skill analyzes raw WordPress Site Health reports (text, screenshots, or debug info). It converts diagnostic data into a prioritized, risk-tiered fix plan, identifying critical issues and recommended improvements. It provides exact, safe commands (WP-CLI/PHP snippets) necessary to address the site and strictly enforces safety protocols like backups, lint checks, and dry-runs.

A comprehensive guide to production-level Laravel architectural patterns. It details best practices for structuring scalable web applications and APIs, covering service layers, dedicated actions, Eloquent ORM modeling, resource design, queue management, and advanced routing techniques like scope bindings. Learn how to maintain clean separation of concerns in large-scale PHP projects.

A comprehensive tool for discovering, vetting, and evaluating Laravel packages. Users can search for packages based on keywords, filter by health score (e.g., Healthy, Unhealthy), and verify compatibility across different Laravel and PHP versions. It helps developers choose actively maintained, robust packages, ensuring project stability and reducing technical debt.

A comprehensive guide to implementing Test-Driven Development (TDD) in Laravel. This resource covers best practices for Unit, Feature, and Integration testing, guiding developers on using PHPUnit and Pest. It details strategies for managing database states (e.g., RefreshDatabase) and effectively mocking external dependencies for robust application development.

Offensive security skill for hunting insecure deserialization flaws in Java, PHP, Python, .NET and Ruby. Covers ysoserial gadget chains, PHP object injection, pickle payloads, ViewState and JNDI/Log4Shell, with strict authorization gates.