Skill UI

A specialized security testing skill designed to identify excessive data exposure in REST or GraphQL APIs, adhering to OWASP API3:2023 guidelines. It works by intercepting raw API responses and systematically comparing the returned data against what the frontend UI actually displays. This helps auditors detect leaked PII, internal identifiers, debug fields, or other sensitive business data that should have been filtered out by the endpoint response. Use cases include auditing microservice boundaries, assessing mobile API responses designed for multiple clients, and verifying proper respons...

This guide provides a comprehensive methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. It teaches testers how to systematically manipulate object identifiers (such as numerical IDs, UUIDs, or slugs) within API requests and URLs. Techniques involve using advanced tools like Burp Suite's Authorize extension to test object-level access control, validating both horizontal (same privilege) and vertical (different privilege) access restrictions during authorized penetration tests or bug bounty engagements.

A specialized skill for discovering and exploiting Mass Assignment vulnerabilities (autobinding) in REST APIs. It guides the injection of unexpected or hidden parameters (such as role or isAdmin) into create/update requests. This technique is crucial during API security assessments to test for privilege escalation, authorization bypass, and unintended parameter binding in ORM-backed endpoints (e.g., Rails, Django).

This guide details implementing comprehensive API security using Google Apigee. It covers multiple advanced policies, including JSON/XML content validation, regex injection detection (SQLi, XSS), rate limiting (SpikeArrest), and robust OAuth 2.0 enforcement. Use this when shielding critical APIs from OWASP API Top 10 threats and malicious client abuse patterns.

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.

A specialized skill for assessing REST and GraphQL APIs against Broken Object Level Authorization (BOLA/IDOR), a critical vulnerability highlighted by OWASP API1:2023. This process involves intercepting API calls, identifying object identifiers (numeric IDs, UUIDs, slugs), and systematically substituting these IDs with those belonging to other users or tenants. It verifies whether the API server correctly enforces per-object authorization checks, mitigating risks of horizontal privilege escalation and unauthorized data access in multi-tenant environments.

polars-bio accelerates genomic interval math and bioinformatics I/O by combining Polars, Arrow, and DataFusion to handle BED/VCF/BAM/GFF/FASTA streams, SQL queries, and cloud storage with overlap, coverage, and nearest APIs plus streaming fallbacks.

Use this helper to search ten academic paper databases via their REST APIs whenever you need research papers, preprints, citation data, metadata, or open-access PDFs; it routes DOI/PMID/author/topic queries to the right endpoints and returns raw JSON plus the queried databases/paths.

Leverages 78 public scientific, biomedical, materials, and economic REST APIs to find compounds, genes, pathways, clinical trials, patents, economic indicators, weather, and other structured data, returning raw JSON plus the databases/endpoints used.

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Covers REST/GraphQL endpoints, type contracts, error semantics, validation, and extensibility principles.

This comprehensive guide outlines established best practices for developing robust, scalable, and high-quality enterprise applications using Spring Boot and Java. It covers structuring projects, implementing dependency injection, designing RESTful APIs, managing transactions, securing endpoints, and utilizing advanced testing strategies (Unit, Integration). Ideal for developers aiming for industry-standard code quality.

This comprehensive guide outlines best practices for developing high-quality, idiomatic, and maintainable enterprise applications using Kotlin and Spring Boot. It covers architectural patterns, dependency injection using primary constructors, managing state with data classes, implementing robust RESTful APIs, handling transactions, and leveraging Kotlin features like null safety and Coroutines for asynchronous programming. It also provides guidance on modern testing strategies (Kotest, Testcontainers).