Skill UI

This comprehensive guide outlines the end-to-end security lifecycle for Kubernetes applications deployed via Helm. It covers critical topics such as chart provenance verification (GPG signing), template scanning (using tools like kubesec and checkov), enforcing strict security contexts, managing secrets securely (ExternalSecrets), and defining robust RBAC rules for CI/CD pipelines.

This skill is designed for assessing the security of Android inter-process communication (IPC) by systematically testing intents, broadcast receivers, content providers, and exported components. It helps identify critical vulnerabilities such as intent injection, unauthorized data leakage, and component hijacking, which are crucial during mobile penetration testing and security audits.

A comprehensive guide for systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks. This includes practical workflows for testing critical vulnerabilities such as Broken Object Level Authorization (BOLA), broken authentication, excessive data exposure, and rate limiting, using tools like Burp Suite, Postman, and ffuf. Ideal for pre-deployment audits and authorized penetration testing engagements.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

This skill guides comprehensive security testing for Host Header Injection vulnerabilities in web applications. It simulates attacks to identify critical risks such as password reset poisoning, web cache poisoning, Server-Side Request Forgery (SSRF), and virtual host routing manipulation. It is essential for penetration testers assessing backend security behind proxies and load balancers.

This guide details a comprehensive methodology for testing JSON Web Token (JWT) implementations against critical security vulnerabilities. It covers attacks such as algorithm confusion (e.g., RS256 to HS256), 'None' algorithm bypass, Key ID (kid) injection, JKU/X5U manipulation, and brute-forcing weak secrets. Essential for API and SSO security assessments.

This skill provides a comprehensive methodology for identifying and exploiting open redirect vulnerabilities in web applications. It covers advanced bypass techniques (e.g., URL encoding, protocol-relative URLs, path traversal) and demonstrates chaining with other flaws like OAuth redirection for advanced phishing simulations and token theft. Designed for authorized security professionals conducting penetration tests.

A comprehensive guide for performing security assessments to identify various forms of sensitive data exposure, such as leaked API keys, PII in API responses, insecure client-side storage, and unprotected data transmission. This workflow covers scanning JavaScript files, analyzing API responses, verifying data encryption, and examining browser storage.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

This comprehensive skill guides the testing of web applications for Cross-Site Scripting (XSS) vulnerabilities. It covers reflected, stored, and DOM-based injection points. Testers learn to map input/output contexts, craft context-appropriate payloads, and bypass complex sanitization and CSP protections, ensuring thorough client-side security assessment.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

This guide details methodologies for identifying and exploiting XML External Entity (XXE) injection vulnerabilities in web applications. It covers basic file retrieval, blind XXE detection using out-of-band techniques, and data exfiltration, all critical steps during authorized penetration testing of XML-consuming APIs and services.