Skill UI

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Automates web application penetration testing by leveraging the penetration-tester plugin to scan OWASP Top 10 threats, suggest exploitation techniques, and produce actionable vulnerability reports for pentest or vulnerability assessment requests.

Guide to mastering essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless checks, and compliance reporting, covering selection, configuration, and practical workflows.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

Execute systematic SQL injection vulnerability assessments on web applications using reconnaissance, payload tuning, and exploitation workflows to uncover database flaws, capture evidence, and validate remediation recommendations for authorized security testing.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.

This tool automates the process of executing the JWT none algorithm attack. It demonstrates how to bypass signature verification by setting the 'alg' header to 'none' in a JSON Web Token. This vulnerability allows attackers to forge tokens with arbitrary claims, such as escalating privileges or impersonating other users, and is crucial for penetration testing and API security auditing.

Nikto is a powerful open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests against over 7,000 potentially dangerous files, checks for outdated server software (over 1,250 versions), and identifies common vulnerabilities including XSS, SQL injection, misconfigurations, and weak SSL/TLS settings. It is essential for penetration testing and rigorous security auditing.

This tool guides the process of reviewing security findings from DAST and SAST scanners. It uses the OWASP risk rating methodology to classify vulnerabilities (true positive, false positive, needs review) and calculate a comprehensive risk score based on likelihood and impact, ensuring development teams prioritize the most critical issues.