Skill UI

A comprehensive tool to inspect and configure critical HTTP security headers (such as CSP, CORS, X-Frame-Options) for modern web applications. It identifies security gaps, assesses cross-origin permissions, and guides users through hardening settings like cookie behavior, ensuring the site meets current industry security standards.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

Expert blockchain developer for production-grade Web3 applications, smart contracts, and decentralized systems. Covers DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integration with security best practices.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Common tools include Burp Suite and Hydra. It is used for security assessments to prevent account takeover and unauthorized access.

Execute comprehensive web application security testing with Burp Suite, covering HTTP interception, request modification, Repeater, scope filtering, and vulnerability scanning for authorized assessments.

Perform dynamic application security testing against running web apps using OWASP ZAP, Burp Suite, Nikto, Nuclei, and Arachni. Automate baseline, full, and API scans in CI/CD to find runtime vulnerabilities.

Master Django 5.x framework for building scalable web applications. This skill covers async views, Django REST Framework, Celery, and Django Channels. It includes best practices for architecture, testing, security, database optimization, and deployment. Suitable for enterprise-level development requiring high performance and maintainability.

Identify and exploit file path traversal vulnerabilities to read arbitrary server files. Used in security assessments to test web application security against directory traversal attacks.

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

A skill for identifying and exploiting authentication bypass vulnerabilities in web applications, including SSO/SAML, OAuth, XMLRPC, and API auth layers. Provides a step-by-step methodology, attack surface signals, and crown jewel targets. For authorized security assessments only.

This skill helps identify CAPTCHA bypass vulnerabilities in web applications by testing various patterns such as omitting the CAPTCHA field, sending empty values, replaying tokens, and testing alternate endpoints. It is intended for authorized security assessments only.

This skill helps security researchers identify HTML injection vulnerabilities in web applications. It provides techniques for detecting unescaped user input, escalating to XSS, and proving impact with unique canaries. Recommended for authorized penetration testing and bug bounty engagements.