Skill UI

This comprehensive guide serves as a reference for offensive security professionals developing custom x86/x64 shellcode. It details advanced concepts including Position-Independent Code (PIC), PEB traversal for API resolution, safe memory allocation (avoiding RWX), and sophisticated process injection methods (e.g., APC injection, threadless techniques). Learn how to bypass modern AV/EDR detection using advanced evasion techniques like API hashing, encryption, direct syscalls, and abusing PE structures.

A comprehensive guide to advanced SQL injection (SQLi) methodologies for offensive security assessments and bug bounty hunting. Covers all major injection types, including error-based, boolean/time-based blind, out-of-band, and second-order injection. Provides specific payloads and techniques for MySQL, MSSQL, PostgreSQL, Oracle, and NoSQL databases, along with methods for bypassing WAFs, exploiting GraphQL, WebSocket, and modern API filters. Includes full automation workflows using tools like sqlmap.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This framework implements the OWASP Top 10 standards, specifically tailored for Agentic Applications. It provides a standardized methodology to classify and map diverse security findings—such as prompt injection, tool misuse, and privilege abuse—to ten core risk categories (ASI01-ASI10). It is essential for security teams to systematically assess, prioritize, and remediate vulnerabilities inherent in complex AI agent systems.

This guide identifies the most common and costly anti-patterns encountered when developing or integrating with Salesforce. It covers critical topics such as SOQL N+1 queries, proper API limit management, preventing SOQL injection, and optimizing data retrieval. Use this resource when reviewing existing Salesforce code, onboarding new developers, or auditing integrations to ensure best performance and scalability.

This guide implements comprehensive policy guardrails for robust Salesforce integrations. It provides solutions for preventing SOQL injection vulnerabilities, detecting hardcoded credentials, throttling API usage at runtime, and enforcing code quality via custom ESLint rules and CI/CD checks. Use this when building secure, scalable, and compliant Salesforce applications.

This skill provides a comprehensive framework for security auditing LLM agents that possess external tools (file system access, command execution, network calls). It employs advanced dialogue probing techniques—such as command injection, path traversal, and SSRF attempts—to identify vulnerabilities where the agent might be induced to execute unexpected or malicious code, or access sensitive resources. Essential for red teaming and securing agent functionalities.

This guide details how to implement custom Content Management System (CMS) field types within a framework. It covers extending the core DataFieldBuilder, composing complex validator interfaces, creating a dedicated FieldTypeFactory, and ensuring proper registration via Dependency Injection (DI) and module augmentation for full TypeScript autocomplete support. Essential for adding fields with specialized validation or storage formats.

This pattern provides a robust method for extending and customizing existing GraphQL APIs. Developers can implement `GraphQLSchemaFactory` to add custom root queries and mutations, injecting complex business logic and use cases directly into the API layer. It fully supports per-resolver dependency injection (DI), ensuring that every resolver has access to critical request-scoped context, such as identity and tenancy, making it ideal for building modular, enterprise-grade backend services.

This guide explains the universal Dependency Injection (DI) pattern used across all Webiny extensions (API, Admin, CLI, Infrastructure). It details how to correctly implement constructor injection using the `dependencies` array to access core services like Logger, BuildParams, CMS use-cases, and IdentityContext. Mastering this pattern is crucial for building maintainable, type-safe, and cohesive Webiny extensions.