Skill UI

This comprehensive checklist guides users through identifying and exploiting open redirect vulnerabilities in web applications. It covers parameter identification, advanced bypass techniques (e.g., URL encoding, CRLF injection), and chaining the vulnerability with other flaws like OAuth or SSRF. Ideal for web application penetration testing and bug bounty hunting.

A comprehensive methodology and checklist for identifying and exploiting race conditions (TOCTOU) in web applications. It guides users to find timing windows, detect vulnerabilities like double-spend or rate limit bypass, and exploit concurrent request flaws in state-changing business logic. Essential for penetration testing and bug bounty hunting.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

This comprehensive guide provides a detailed methodology for detecting and exploiting Server-Side Request Forgery (SSRF) vulnerabilities. It covers basic, blind, and out-of-band techniques, including testing against cloud metadata endpoints (AWS/GCP/Azure) and advanced bypass methods like DNS rebinding. It is an essential resource for web application security testing and bug bounty hunting.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This guide provides a complete, end-to-end workflow for implementing Know Your Customer (KYC) identity verification using the Persona API. It details both backend implementation (creating inquiries, handling completion callbacks, resuming flows) and frontend integration (embedding the verification UI into web applications). Ideal for secure user onboarding and identity validation processes.

This guide demonstrates how to set up a secure and robust webhook endpoint to process identity verification events from Persona. It covers essential security practices, including HMAC signature verification using TypeScript and Express, handling critical KYC lifecycle events (like inquiry approval/declination), and implementing idempotent processing to prevent data duplication. Ideal for integrating third-party identity services into a web application.

This skill scans live websites or local codebases to detect all data collection signals, including cookies, analytics, forms, and third-party processors. It then generates a comprehensive, 12-section privacy policy tailored for GDPR and CCPA compliance. The system maps detected data touchpoints to specific legal bases (Consent, Contract, etc.), ensuring the resulting policy accurately reflects the actual data practices of your application or website.

This skill provides implementation patterns for integrating with QuickNode, utilizing blockchain RPC endpoints and the QuickNode SDK. It guides developers on connecting, checking block numbers, and interacting with the Ethereum/Web3 blockchain infrastructure. It is crucial for any developer working on decentralized applications or CI/CD pipelines that require reliable blockchain access.

This detailed workflow guides developers through essential Ethereum Virtual Machine (EVM) transaction processes using QuickNode infrastructure. It covers core functionalities such as initiating ETH transfers, calling smart contract write functions, setting up real-time event listeners via WebSocket, and accurately estimating gas costs. It is ideal for building robust decentralized applications (dApps) and blockchain backend services.