Skill UI

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

Gradio is a Python library for creating interactive web user interfaces and machine learning demos. This skill covers building Gradio applications, including components, event listeners, layouts, and chatbots. It includes guides on Interface, Blocks, and ChatInterface patterns, along with key component signatures like Textbox, Number, and Slider for rapid prototyping and deployment.

A skill for identifying and exploiting authentication bypass vulnerabilities in web applications, including SSO/SAML, OAuth, XMLRPC, and API auth layers. Provides a step-by-step methodology, attack surface signals, and crown jewel targets. For authorized security assessments only.

A skill for identifying and exploiting business logic vulnerabilities in web applications, focusing on payment flows, verification bypasses, rate-limiting issues, and unprotected internal surfaces. Requires explicit authorization for testing.

This skill helps identify CAPTCHA bypass vulnerabilities in web applications by testing various patterns such as omitting the CAPTCHA field, sending empty values, replaying tokens, and testing alternate endpoints. It is intended for authorized security assessments only.

A skill for hunting CSRF vulnerabilities in web applications. Covers raw HTTP client techniques, token bypass methods, and high-value target identification, with an emphasis on authorized testing.

This skill helps security researchers identify HTML injection vulnerabilities in web applications. It provides techniques for detecting unescaped user input, escalating to XSS, and proving impact with unique canaries. Recommended for authorized penetration testing and bug bounty engagements.

Hunt LDAP injection and XPath injection vulnerabilities in web applications. Covers authentication bypass, blind attribute exfiltration, and Active Directory vs generic LDAP differences. Includes attack surface signals, filter grammar, and authorized-use guidance.

A specialized security skill for identifying and exploiting race condition vulnerabilities in web applications. Focuses on synchronized request attacks, double-spending, and bypassing access controls. Requires explicit authorization and defensive guidance protocols before execution.

A skill for identifying Remote Code Execution (RCE) vulnerabilities across web applications and infrastructure. Based on bug bounty reports, it guides users to test command injection, template injection, and configuration flaws on admin consoles, APIs, and supply chain targets. Requires explicit authorization for ethical testing.

Extract backend API routes from SPA JavaScript bundles to identify missing authentication or broken access control vulnerabilities. Test endpoints without credentials to find unauthenticated data exposure and security gaps in web applications.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.