Skill UI

A comprehensive checklist designed for assessing the security posture of GraphQL endpoints. It covers advanced vulnerabilities such as introspection abuse, IDOR, query depth/complexity DoS, injection attacks (SQLi/NoSQLi), and authorization bypass mechanisms. Essential for professional penetration testing and bug bounty hunting.

This comprehensive checklist provides a detailed methodology for simulating the initial access phase in red team engagements and penetration testing. It covers a wide spectrum of modern attack vectors, including advanced social engineering (e.g., deepfake, BEC), sophisticated phishing (spear/smishing), exploiting exposed perimeter services (RDP/VPN), and identifying cloud misconfigurations. Use this guide when planning or executing the initial foothold stage to ensure comprehensive coverage against modern threats.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A comprehensive guide to advanced SQL injection (SQLi) methodologies for offensive security assessments and bug bounty hunting. Covers all major injection types, including error-based, boolean/time-based blind, out-of-band, and second-order injection. Provides specific payloads and techniques for MySQL, MSSQL, PostgreSQL, Oracle, and NoSQL databases, along with methods for bypassing WAFs, exploiting GraphQL, WebSocket, and modern API filters. Includes full automation workflows using tools like sqlmap.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

This comprehensive guide serves as a complete error decoder for the OneNote Graph API. It analyzes major HTTP status codes (400, 403, 404, 429, 500, 502, 507) and provides root cause analysis, diagnostic steps, and code fixes for common issues. It specifically addresses critical failure modes like deprecated authentication methods and silent 200 OK failures, helping developers debug complex API integrations in production.

This skill provides a comprehensive guide and code examples for creating a complete OneNote structure (Notebook, Section, and Page) using the Microsoft Graph API. It specifically addresses the critical technical requirement that OneNote content must follow strict XHTML standards, detailing common HTML pitfalls (such as unclosed tags, unsupported attributes, and merge cell usage) that can lead to silent content corruption during API calls.

Comprehensive guide for setting up delegated authentication for the OneNote Graph API using MSAL. Learn how to register applications in Azure AD, configure precise permission scopes, install SDKs (Python/TypeScript), and implement token caching. This guide specifically addresses the migration from deprecated app-only authentication methods.

A comprehensive guide to launching, listing, and managing Oracle Cloud Infrastructure (OCI) compute instances using Python. This guide specifically addresses the common 'Out of host capacity' error when using Always Free ARM shapes, implementing a robust retry loop to ensure successful deployment. Users can learn the full lifecycle management, from initial connection setup to instance state polling.

This comprehensive skill guide provides deep insight into Oracle Cloud Infrastructure (OCI) IAM policy syntax and best practices. It covers the privilege verb hierarchy (inspect, read, use, manage), the correct structure for policy statements, and common patterns for granting least-privilege access across various compartments. Use this when developing automation scripts, setting up complex access control policies, or performing security audits in OCI.

A specialized AI agent designed to build and audit business models using Alexander Osterwalder’s comprehensive 9-block framework. It moves beyond mere filling of blocks, focusing on establishing the critical logical 'lock' between core components like Value Propositions, Customer Segments, and Cost Structures. This tool is ideal for initial business architecture design, auditing existing models for internal consistency (e.g., ensuring every key activity has a corresponding cost), or re-validating the core logic during a strategic pivot.