Skill UI

Run comprehensive web application security assessments through Burp Suite’s proxy, repeater, and scanner features to intercept, modify, and analyze HTTP traffic while spotting vulnerabilities for remediation planning.

Analyzes smart contract codebases against Trail of Bits development guidelines, covering documentation, architecture, upgradeability, proxy patterns, implementation quality, dependencies, and testing to deliver prioritized recommendations and actionable improvements.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.

A comprehensive guide to simulating Man-in-the-Middle (MITM) attacks using industry-standard tools like Bettercap, Ettercap, and mitmproxy. This technique is strictly for authorized penetration testing environments to assess cryptographic controls, validate TLS certificate pinning, and test network defense mechanisms against ARP/DNS spoofing and sniffing.

This technique details how to exploit misconfigurations within Kerberos Constrained Delegation (KCD) in Active Directory. By leveraging S4U2self and S4U2proxy extensions, attackers can impersonate highly privileged users (e.g., Domain Admins) to request service tickets, enabling lateral movement and full domain compromise during authorized red teaming or penetration testing.

A comprehensive guide for authorized penetration testing on detecting and exploiting HTTP Request Smuggling vulnerabilities. It details analyzing discrepancies between Content-Length and Transfer-Encoding header parsing in multi-tier architectures (e.g., CDN, reverse proxy, load balancers). Learn techniques to bypass access controls, capture subsequent user requests, and escalate attacks in a controlled environment.

Outlines a comprehensive, fast local development loop for applications hosted on Fly.io. It guides users through testing Docker containers locally, proxying remote services like Postgres and Redis to localhost, configuring dev environments, and performing fast deployment cycles. Essential for modern edge computing development.

A comprehensive guide and setup for establishing a fast, reproducible local development loop for web scraping projects using Bright Data. It includes configuring proxy modules, implementing response caching to save credits, and setting up mocked test suites (using Vitest) for robust, isolated testing without requiring live proxy access or consuming resources.

This guide details setting up continuous integration and continuous deployment (CI/CD) pipelines for web scraping projects. It integrates Bright Data proxy testing into GitHub Actions, allowing developers to run both mocked unit tests (for quick checks) and live integration tests (verifying actual proxy connectivity) automatically upon code push or pull request.

Designed to handle API integrations for services like Navan that lack a dedicated sandbox environment. This skill implements robust environment isolation (Development, Staging, Production) using separate OAuth credentials, advanced environment variable management, and a local development proxy/mock server. It ensures that development, testing, and CI/CD processes can run safely without modifying live production data.

This expert playbook details advanced attack vectors specific to the HTTP/2 protocol. It covers sophisticated techniques such as h2c smuggling, exploiting pseudo-header discrepancies, HPACK compression vulnerabilities, and abusing stream multiplexing. Use this skill for professional penetration testing and security auditing of H2 services, especially for bypassing proxy-level controls and WAFs.