Skill UI

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

A comprehensive guide for systematically assessing web applications and APIs for broken access control vulnerabilities (OWASP A01:2021). The methodology covers role-based access control (RBAC) auditing, horizontal and vertical privilege escalation, and multi-tenant data leakage using tools like Burp Suite, ffuf, and custom scripts. Essential for authorized penetration testing and security audits.

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

This skill guides comprehensive security testing for Host Header Injection vulnerabilities in web applications. It simulates attacks to identify critical risks such as password reset poisoning, web cache poisoning, Server-Side Request Forgery (SSRF), and virtual host routing manipulation. It is essential for penetration testers assessing backend security behind proxies and load balancers.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A detailed methodology for identifying Cross-Site Scripting (XSS) vulnerabilities across web applications. It guides systematic testing for Reflected, Stored, and DOM-based XSS, covering payload bypass, output encoding evaluation, and assessing Content Security Policy (CSP) protection. Essential for OWASP WSTG testing and client-side security audits.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

Security-first development practices for web applications. Covers threat modeling with STRIDE, OWASP Top Ten defenses, input validation, parameterized queries, authentication and session hardening, security headers, dependency auditing, and supply-chain risk assessment.

This comprehensive guide outlines essential security best practices for integrating with Adobe APIs. It covers securing OAuth credentials, implementing least-privilege scoping, managing zero-downtime credential rotation, and verifying I/O Events webhook signatures using cryptographic methods like RSA-SHA256. Essential for building secure, production-ready applications connected to Adobe services.

A comprehensive checklist and script to validate the production readiness of decentralized applications (dApps) powered by Alchemy. It covers critical security best practices, API infrastructure validation, smart contract deployment checks, and performance optimization, ensuring a stable and secure mainnet launch.

A comprehensive guide to securing Web3 applications utilizing Alchemy. It covers critical best practices, including implementing secure API key proxies, managing private keys via secret vaults, validating blockchain inputs (addresses, block numbers), and verifying webhook signatures to harden your dApp infrastructure.

This comprehensive guide provides essential security best practices for deploying applications on Fly.io. It covers critical areas such as secrets management, private networking using WireGuard, securing TLS certificates, and properly scoping deploy tokens. The included functions demonstrate how to validate API tokens, verify webhook signatures, and validate deployment configurations to mitigate common cloud and application-level vulnerabilities.