Download

Skill UI

Browse and discover 9699+ curated skills

All Development Artificial Intelligence Design & Creative Product & Business Data Science Marketing Soft Skills Productivity Engineering Languages

Search Security , found 984 results

Default Newest Most Downloaded

Server-Side Request Forgery Expert Playbook

ssrf-server-side-request-forgery

yaklang/hack-skills

This comprehensive playbook details expert techniques for exploiting Server-Side Request Forgery (SSRF). It covers bypassing URL filters, accessing cloud metadata endpoints (AWS, GCP, Azure), utilizing advanced protocols like Gopher, and chaining vulnerabilities to achieve Remote Code Execution (RCE) in real-world scenarios. Ideal for penetration testers and security researchers.

Advanced SSTI Exploitation Techniques

ssti-server-side-template-injection

yaklang/hack-skills

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.

Subdomain Takeover Detection And Exploitation

subdomain-takeover

yaklang/hack-skills

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

PHP Type Juggling and Weak Comparison Bypass

yaklang/hack-skills

A comprehensive guide to exploiting PHP's loose type checking (using '==') and type juggling mechanics. This skill is crucial for bypassing security controls like authentication checks, HMAC/signature validations, and token comparisons that fail to use strictly typed comparisons (===) or timing-safe functions (hash_equals). Includes techniques for magic hash collisions and PHP version delta analysis.

Unauthorized Access to Common Services

unauthorized-access-common-services

yaklang/hack-skills

A comprehensive playbook detailing expert techniques for exploiting common network services (such as Redis, Rsync, PHP-FPM, AJP, etc.) when they are exposed without proper authentication or weak access controls. This guide covers various methods including RCE, data theft, and file reading, crucial for advanced penetration testing and infrastructure security assessments.

Insecure File Upload Vulnerability Testing

upload-insecure-files

yaklang/hack-skills

A comprehensive, expert playbook for challenging insecure file upload mechanisms. It provides advanced attack vectors covering validation bypass (magic bytes, extension), storage path abuse (traversal, overwrite), and exploitation of post-upload processing chains (XXE, RCE, CMDi). Essential for deep security auditing of file-handling workflows.

Waf Bypass Techniques and Evasion Playbook

waf-bypass-techniques

yaklang/hack-skills

A comprehensive playbook detailing advanced methods to bypass Web Application Firewalls (WAFs) when standard injection payloads (SQLi, XSS, RCE) are blocked. Techniques include encoding (URL, Unicode, Hex), protocol abuse (HTTP/2, chunking), parameter pollution, and path normalization tricks, allowing security professionals to test robust application defenses.

Advanced Web Cache Deception and Poisoning

web-cache-deception

yaklang/hack-skills

A comprehensive playbook detailing expert-level techniques for exploiting web cache vulnerabilities. Covers both Web Cache Deception (stealing authenticated user data) and Web Cache Poisoning (injecting malicious content). Techniques include path confusion, unkeyed header manipulation (X-Forwarded-Host), and exploiting CDN/reverse proxy caching logic. Essential reading for penetration testers and security researchers.

WebSocket Security Testing and Analysis

websocket-security

yaklang/hack-skills

This skill provides comprehensive testing for WebSocket APIs, covering protocol basics, Cross-Site WebSocket Hijacking (CSWSH), and common security flaws. Use it when testing applications that rely on real-time communication, chat features, or persistent data streams. It validates Origin checks, session binding, and message integrity.

Doubt-Driven Adversarial Code Review

doubt-driven-development

addyosmani/agent-skills

A structured methodology for validating non-trivial decisions by subjecting them to an adversarial, fresh-context review. This process is crucial when correctness is paramount—such as in production, security-sensitive logic, or complex architecture—by forcing a skeptical examination that aims to disprove assumptions rather than simply approve them.

Pre-Production Codebase Audit Gate

alirezarezvani/claude-skills

A comprehensive pre-production audit tool that scans a codebase for critical issues across eight dimensions: security, database, deployment, code quality, AI/LLM usage, dependencies, frontend, and observability. It intercepts deployment commands, forcing users to resolve critical failures before shipping code. The audit is stack-agnostic and provides detailed pass/fail/manual reports.

Homelab Network Readiness Planning

homelab-network-readiness

affaan-m/everything-claude-code

This skill guides the planning and review process for complex home or small-lab network changes. It covers creating staged migration plans for VLAN segmentation, implementing local DNS resolvers (like Pi-hole), setting up secure VPN access, and ensuring network safety through detailed inventory checks and rollback procedures. It emphasizes security best practices and trust zoning.

Prev 1 2 3...78 79 808182 Next

Language