Skill UI

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

A powerful tool for conducting comprehensive academic research and literature reviews. It searches, analyzes, and synthesizes key ideas from multiple sources, including local PDF libraries (Zotero, Obsidian), the general web, and specialized academic databases (Semantic Scholar, DeepXiv). Use this when you need to map the historical context, identify related works, or understand complex concepts across multiple studies on a given topic.

A comprehensive guide detailing the use of Tenable Nessus, an industry-leading vulnerability scanner. Learn how to configure advanced scan policies, perform both authenticated and unauthenticated scans across servers, network devices, and web applications. This skill covers end-to-end processes from execution to result analysis and reporting.

This skill demonstrates how to secure AWS API Gateway endpoints using AWS WAF (Web Application Firewall). It implements essential security measures including protection against OWASP Top 10 vulnerabilities, custom rate-limiting rules, IP reputation filtering, and bot control. Ideal for deploying public API endpoints that require robust defense against common web attacks and API abuse.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

A comprehensive guide for systematically assessing web applications and APIs for broken access control vulnerabilities (OWASP A01:2021). The methodology covers role-based access control (RBAC) auditing, horizontal and vertical privilege escalation, and multi-tenant data leakage using tools like Burp Suite, ffuf, and custom scripts. Essential for authorized penetration testing and security audits.

A comprehensive guide for manually assessing critical business rules and workflows in web applications. This technique goes beyond automated scanning by simulating attacks like price manipulation, multi-step process bypass, and privilege escalation. Ideal for securing e-commerce checkout funnels, financial transactions, and complex authorization systems.

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

This skill guides comprehensive security testing for Host Header Injection vulnerabilities in web applications. It simulates attacks to identify critical risks such as password reset poisoning, web cache poisoning, Server-Side Request Forgery (SSRF), and virtual host routing manipulation. It is essential for penetration testers assessing backend security behind proxies and load balancers.

A comprehensive skill guide for assessing JSON Web Token (JWT) security flaws. This technique covers advanced attack vectors such as algorithm confusion (e.g., RS256 to HS256), 'none' algorithm bypass, key ID (kid) injection, and JKU/X5U parameter manipulation. It also includes methods for brute-forcing weak symmetric secrets and is essential for penetration testing OAuth2/OIDC and SSO systems.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A detailed methodology for identifying Cross-Site Scripting (XSS) vulnerabilities across web applications. It guides systematic testing for Reflected, Stored, and DOM-based XSS, covering payload bypass, output encoding evaluation, and assessing Content Security Policy (CSP) protection. Essential for OWASP WSTG testing and client-side security audits.