Skill UI

A comprehensive guide for authorized penetration testers on identifying and exploiting Cross-Site Request Forgery (CSRF) vulnerabilities. This skill covers analyzing state-changing requests, testing anti-CSRF token implementations, and verifying defenses like SameSite cookies and Origin/Referer header validation using tools like Burp Suite.

This comprehensive guide details methods for testing web applications against directory traversal (path traversal) and local/remote file inclusion (LFI/RFI) vulnerabilities. It covers advanced techniques, including path manipulation, encoding bypasses, and automated fuzzing using tools like ffuf and dotdotpwn. Use this during authorized penetration tests to assess file download, view, or include functionality.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.

This skill provides a comprehensive framework for performing authorized penetration testing on Google Cloud Platform (GCP). It uses specialized tools like GCPBucketBrute to enumerate publicly accessible storage buckets and audits IAM policies to identify overly permissive role bindings. The process includes checking service account keys and mapping potential privilege escalation paths, generating actionable, risk-scored reports for robust cloud security posture management.

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

This skill automates GraphQL introspection attacks to extract the complete API schema, including all types, queries, mutations, and subscriptions. It maps the attack surface, tests for query depth limits, and exploits GraphQL-specific weaknesses like batching attacks or nested query DoS. Used for comprehensive GraphQL security auditing and penetration testing.

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.

This skill teaches authorized users how to perform comprehensive password hash cracking using Hashcat. It covers various attack methodologies, including dictionary, brute-force, and rule-based attacks, and identification of common hash types (e.g., MD5, NTLM, bcrypt). The primary use case is for conducting controlled security assessments and penetration testing to evaluate password strength and compliance with current security policies. Always used under explicit authorization.

This skill details how to execute HTTP Parameter Pollution (HPP) attacks. HPP exploits differences in how web applications and Web Application Firewalls (WAFs) process duplicate parameters within a single request (e.g., query strings or POST bodies). It is crucial for penetration testing to bypass input validation, WAF rules, and uncover parameter parsing inconsistencies in APIs and web forms.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

A specialized tool for authorized penetration testing and security assessments. It exploits the vulnerability of JWT libraries that accept tokens with the "alg": "none" header, bypassing cryptographic signature verification. Users can craft tokens with arbitrary claims (e.g., elevated privileges, impersonation) to validate that a target server correctly rejects unsigned JSON Web Tokens.