Skill UI

HTTP Parameter Pollution (HPP) occurs when a single request contains multiple instances of the same parameter key. Different components in the request path (e.g., WAFs, proxies, application frameworks) may parse these duplicate keys using different rules (first value, last value, array join). This skill teaches how to exploit these discrepancies to bypass security checks, execute SSRF, or manipulate business logic.

This expert playbook details advanced attack vectors specific to the HTTP/2 protocol. It covers sophisticated techniques such as h2c smuggling, exploiting pseudo-header discrepancies, HPACK compression vulnerabilities, and abusing stream multiplexing. Use this skill for professional penetration testing and security auditing of H2 services, especially for bypassing proxy-level controls and WAFs.

This expert playbook details advanced techniques for bypassing SSL pinning mechanisms (Certificate, Public Key, SPKI) on mobile applications running on Android and iOS. It provides practical methods using tools like Frida and Objection, covering various frameworks (Flutter, React Native, Xamarin) and multiple pinning types to enable the interception and analysis of encrypted HTTPS traffic.

An expert-level playbook detailing advanced techniques for NTLM relay and authentication coercion. Covers cross-protocol attacks targeting SMB, LDAP, HTTP, and MSSQL. Includes methods like LLMNR poisoning, PetitPotam, and advanced domain privilege escalation to bypass standard authentication controls.

A comprehensive playbook for advanced security testing, focusing on race conditions and TOCTOU (Time-of-check to time-of-use) vulnerabilities in web applications. It guides users to exploit non-atomic, state-changing operations (e.g., coupons, balance deductions, single-use rewards) by sending highly synchronized, parallel requests (including HTTP/2 single-packet attacks). Essential for identifying weaknesses in authorization and transactional integrity.

This expert playbook covers advanced techniques for testing HTTP request smuggling and desynchronization vulnerabilities. It is critical when front proxies, CDNs, or load balancers disagree with the origin server on message framing (Content-Length vs Transfer-Encoding), or during protocol downgrades (HTTP/2 to HTTP/1). Use this to uncover deep security flaws like WAF bypass and session hijacking.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

A comprehensive playbook detailing advanced methods to bypass Web Application Firewalls (WAFs) when standard injection payloads (SQLi, XSS, RCE) are blocked. Techniques include encoding (URL, Unicode, Hex), protocol abuse (HTTP/2, chunking), parameter pollution, and path normalization tricks, allowing security professionals to test robust application defenses.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

This skill provides a mechanism to execute TypeScript scripts using tsx, enabling fetching and streaming responses from external HTTP endpoints. It is designed for users who need a lightweight Node.js helper utility to manage simple network API calls, making it ideal for rapid integration and data fetching tasks.

This skill guides the creation of production-grade Model Context Protocol (MCP) servers and basic clients using C# and the .NET framework. It ensures adherence to the stable 2.x specification, addressing common pitfalls like stateful/stateless HTTP defaults, handling deprecations (roots, sampling), and utilizing appropriate transports (STDIO, Streamable HTTP). Essential for developers integrating structured AI APIs into enterprise applications.

This guide details the architectural and implementation patterns for building modular applications or microservices using the tinystruct Java framework. It covers core concepts like using the @Action annotation for dual routing (CLI/HTTP), managing request state with Context, and using native Builder for JSON serialization, ensuring a lightweight and structured development environment.