Skill UI

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

This skill provides a comprehensive framework for security auditing LLM agents that possess external tools (file system access, command execution, network calls). It employs advanced dialogue probing techniques—such as command injection, path traversal, and SSRF attempts—to identify vulnerabilities where the agent might be induced to execute unexpected or malicious code, or access sensitive resources. Essential for red teaming and securing agent functionalities.

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

This router entry point is designed for comprehensive testing of file access, download endpoints, and file upload workflows. Use this guide when validating file paths, detecting Local File Inclusion (LFI), or analyzing vulnerabilities in preview, storage, or extraction processes. It helps categorize whether the security issue relates to path traversal or insecure data processing chains.

A sophisticated payload bypass technique targeting Java applications. It exploits the silent loss of high 8 bits when 16-bit Java characters are cast or written as 8-bit bytes. This allows attackers to bypass WAF/IDS security measures by making the WAF see harmless Unicode, while the backend service processes the original malicious ASCII byte payload. Ideal for blind SQLi, deserialization RCE, and path traversal. This primitive affects major frameworks like Tomcat, Spring, Jackson, and HttpClient.

A deep-dive playbook covering expert techniques for Path Traversal and Local File Inclusion (LFI). It details multiple bypass methods (encoding, null bytes, wrappers), target file enumeration on Linux and Windows, and advanced Remote Code Execution (RCE) escalation paths, such as log poisoning via PHP wrappers.

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.

This tool performs pathfinder traversal across a knowledge graph starting from a specified seed entity. It expands outward through causal edges, calculates path relevance scores, and prunes low-similarity branches. It is ideal for conducting impact analyses, tracing dependency chains, or understanding complex relationships within a structured knowledge base.

This comprehensive guide covers essential security patterns for Perl development, addressing common vulnerabilities like SQL Injection, XSS, Path Traversal, and Shell Injection. It details best practices including using Perl's Taint Mode, implementing strict allow-list validation, performing safe file operations, and executing external commands securely to ensure robust and resilient applications.

Identify and exploit file path traversal vulnerabilities to read arbitrary server files. Used in security assessments to test web application security against directory traversal attacks.

Detect unsafe file handling and path traversal vulnerabilities in upload, save, and extract flows. Focuses on user-controlled paths or filenames, providing probes to test if agents write outside intended directories. Useful for security assessment of AI agents with file handling capabilities.

Expert in handling file uploads and cloud storage solutions like S3 and Cloudflare R2. Covers presigned URLs, multipart uploads, and image optimization. Ensures security by validating file types and preventing path traversal attacks. Optimizes performance for large files without blocking.