Skill UI

This skill focuses on identifying clickjacking vulnerabilities where malicious sites overlay transparent iframes over legitimate pages to trick users into unintended actions. It involves checking security headers like X-Frame-Options and CSP, verifying if sensitive actions can be triggered via framing, and ensuring proper authorization before testing. It is strictly for authorized security assessments and bug bounty programs.

A skill for hunting CSRF vulnerabilities in web applications. Covers raw HTTP client techniques, token bypass methods, and high-value target identification, with an emphasis on authorized testing.

Technique for authorized bug-bounty and penetration-testing engagements that hunts mishandled exceptional conditions in web apps, inducing unhandled exceptions with wrong-type, malformed, or boundary inputs to detect verbose stack traces, ORM internals, server paths, and framework version leaks.

A security skill for identifying and exploiting Host header injection vulnerabilities, including password reset poisoning, web cache poisoning, and routing-based SSRF. Provides step-by-step testing methodology and commands for authorized assessments only. Built from public research and real-world findings.

This skill helps security researchers identify HTML injection vulnerabilities in web applications. It provides techniques for detecting unescaped user input, escalating to XSS, and proving impact with unique canaries. Recommended for authorized penetration testing and bug bounty engagements.

A skill for identifying Remote Code Execution (RCE) vulnerabilities across web applications and infrastructure. Based on bug bounty reports, it guides users to test command injection, template injection, and configuration flaws on admin consoles, APIs, and supply chain targets. Requires explicit authorization for ethical testing.

Authorized security testing skill for hunting exposed source maps, .env files, .git directories, and Swagger/OpenAPI specs to uncover leaked credentials, internal endpoints, and auth logic gaps in web targets.

A security assessment skill for identifying WebSocket vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), message tampering, handshake-layer attacks, and socket.io authorization bypasses. Requires explicit written authorization before testing. Includes reconnaissance, endpoint discovery, and exploit verification techniques for authorized security assessments.

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation, exploitation via Burp Suite, and remediation strategies. Requires authorized security assessments and multiple test accounts to verify cross-user access. Outputs include vulnerability reports, proof of concept, and remediation recommendations.

Master modern Julia 1.10+ development with performance optimization, multiple dispatch, and production-ready practices. Covers scientific computing, data science, machine learning, web development, and package management. Focus on type stability, modern tooling, testing, and CI/CD pipelines for high-performance applications.

This skill guides users to configure and test common network services like HTTP, HTTPS, SNMP, and SMB within a controlled penetration testing lab environment. It covers service enumeration, log analysis, and security testing procedures. Users will learn to set up web servers, secure connections, and file shares while practicing defensive and offensive security techniques on properly configured target systems.

This skill provides a comprehensive command reference for penetration testing tools. It covers network scanning with Nmap, exploitation via Metasploit, password cracking, and web application testing. Users can quickly lookup commands for security assessments, vulnerability identification, and payload generation. It includes examples for host discovery, port scanning, service detection, and common exploit usage.