Skill UI

Assess web apps for client-side injection flaws, covering stored, reflected, and DOM XSS plus HTML injection, demonstrate session hijacking payloads, and guide validation and sanitization checks.

Guides analysts through assessing web authentication, credential stuffing, password policies, session tokens, and fixation flows to uncover broken authentication risks before attackers do.

Guides intercepting HTTP traffic, modifying requests, using Repeater, defining scope, and running Burp Suite scans for systematic web application security testing.

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Run targeted file path traversal assessments to find directory traversal and LFI vulnerabilities across web parameters, verify exploitation payloads, and document sensitive files exposed via automated fuzzing and manual checks.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

Comprehensive guidance on using Shodan’s web UI, CLI, and API for reconnaissance, exposed-service discovery, screenshot capture, and exporting JSON/CSV data during penetration tests.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.

This comprehensive guide details the use of FFUF, a fast web fuzzer written in Go. It is designed for advanced security penetration testing, providing techniques for content discovery, subdomain enumeration, parameter fuzzing, and POST data testing. Learn to master the FUZZ keyword, advanced filtering, and auto-calibration to efficiently identify hidden paths and potential vulnerabilities in web applications.

This skill generates a complete, opinionated, modern full-stack Rails application boilerplate. It sets up a robust tech stack including Rails 8, PostgreSQL, React, Inertia.js, Vite, Tailwind CSS, Sidekiq, and Redis. Designed for developers who need a starting point that adheres to best practices for database structure (UUIDs, JSONB), background job processing, comprehensive testing, and modern frontend development (TSX). Ideal for bootstrapping complex, production-grade web services.

A scientific, customer-centric framework for systematically improving conversion rates on websites and landing pages. This methodology guides users through funnel mapping, identifying core visitor objections, and conducting evidence-based A/B testing. It is essential for auditing underperforming funnels, optimizing checkout flows, and transforming general marketing hypotheses into measurable, statistically significant improvements.