Skill UI

Hunting methodology for OAuth vulnerabilities from 22 bug bounty reports, covering redirect_uri bypass, CSRF state, nonce replay, referrer leakage, and mobile deep link attacks for authorized security assessments.

Methodology for hunting open redirect flaws in web apps: parameter discovery, bypass payloads, DOM-based sinks, OAuth auth-code theft chains and SSRF escalation. Docs-only, for authorized bug bounty and pentest use.

A specialized security skill for identifying and exploiting race condition vulnerabilities in web applications. Focuses on synchronized request attacks, double-spending, and bypassing access controls. Requires explicit authorization and defensive guidance protocols before execution.

This skill identifies session management vulnerabilities like session fixation, failure to invalidate sessions after logout or password changes, and weak session ID generation. It is designed for authorized security assessments to prevent Account Takeover (ATO) and unauthorized access. Users must obtain explicit written permission before testing targets.

A security skill for hunting server-side request forgery (SSRF) vulnerabilities, covering cloud metadata, internal services, OOB confirmation, and authorized testing workflows.

This skill enables security professionals to identify subdomain takeover vulnerabilities by enumerating subdomains, analyzing DNS records, and verifying unclaimed third-party resources. It is used in authorized security assessments to find high-value targets like GitHub Pages, GitLab Pages, or S3 buckets that can be exploited to serve malicious content under a trusted domain.

A security assessment skill for identifying WebSocket vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), message tampering, handshake-layer attacks, and socket.io authorization bypasses. Requires explicit written authorization before testing. Includes reconnaissance, endpoint discovery, and exploit verification techniques for authorized security assessments.

Hunts reflected, stored and blind XSS during authorized web security assessments: reflection verification, unique canary payloads, context-based injection and out-of-band confirmation.

Authorized-use hunting guide for XXE vulnerabilities: maps XML entry points, tests file uploads, SAML and SOAP endpoints, then escalates from inline file read to blind out-of-band exfiltration, SSRF pivoting and internal service access.

Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.

This skill provides a structured five-phase workflow for bug bounty and SRC vulnerability hunting. It guides users through intake, reconnaissance, enumeration, active hunting, and reporting. Includes attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, CSRF, and file upload vulnerabilities. Features WAF bypass techniques, industry-specific guides, and evidence discipline for compliance.

This skill helps identify similar vulnerabilities and bugs across codebases using pattern-based analysis. It is used for hunting bug variants, building CodeQL or Semgrep queries, analyzing security vulnerabilities, and performing systematic code audits after an initial issue is found. It involves understanding root causes, creating exact match patterns, and iteratively generalizing search criteria while avoiding false positives.