القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ١٤٦ من skills من EntroVyx/hermes-agent-offsec. افتح أي skill لمراجعة مصدره وتفاصيله.
EntroVyx/hermes-agent-offsecعرض ٤٠ من أصل ١٤٦ skills مجمعة.
Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses…
لغة النص الأصلي: الإنجليزية
Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
لغة النص الأصلي: الإنجليزية
Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal…
لغة النص الأصلي: الإنجليزية
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…
لغة النص الأصلي: الإنجليزية
Hunt public /metrics, /health, and actuator endpoints leaking AI usage, DB pools, and operational intelligence.
لغة النص الأصلي: الإنجليزية
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice),…
لغة النص الأصلي: الإنجليزية
Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection,…
لغة النص الأصلي: الإنجليزية
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
لغة النص الأصلي: الإنجليزية
Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
لغة النص الأصلي: الإنجليزية
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
لغة النص الأصلي: الإنجليزية
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync…
لغة النص الأصلي: الإنجليزية
Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
لغة النص الأصلي: الإنجليزية
Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com),…
لغة النص الأصلي: الإنجليزية
Enumerate hidden tables, fields, and endpoints via API error hints. Agnostic across PostgREST, Zod, FastAPI, GraphQL, and REST.
لغة النص الأصلي: الإنجليزية
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token…
لغة النص الأصلي: الإنجليزية
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info…
لغة النص الأصلي: الإنجليزية
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005,…
لغة النص الأصلي: الإنجليزية
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k),…
لغة النص الأصلي: الإنجليزية
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once…
لغة النص الأصلي: الإنجليزية
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email…
لغة النص الأصلي: الإنجليزية
Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing,…
لغة النص الأصلي: الإنجليزية
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of…
لغة النص الأصلي: الإنجليزية
Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade…
لغة النص الأصلي: الإنجليزية
Hunt WordPress-specific vulnerabilities — REST API user enumeration, XMLRPC brute force + SSRF + upload, CORS credential reflect on WP REST API, open registration, cross-subdirectory plugin discovery, Yoast sitemap email disclosure, Application Passwords…
لغة النص الأصلي: الإنجليزية
Hunt read-protected write-gaping endpoints. PATCH/POST/DELETE without authorization while GET is protected. Agnostic: Supabase, Firebase, REST, GraphQL.
لغة النص الأصلي: الإنجليزية
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
لغة النص الأصلي: الإنجليزية
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and…
لغة النص الأصلي: الإنجليزية
Manual-first bug bounty and pentest methodology built from a top-paid disclosed HackerOne sample. Use when testing real application behavior beyond scanner output: business logic, authorization drift, workflow abuse, state-machine flaws, onboarding abuse,…
لغة النص الأصلي: الإنجليزية
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent…
لغة النص الأصلي: الإنجليزية
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep —…
لغة النص الأصلي: الإنجليزية
Kernel-level proxy protection via proxy-ns — forces ALL traffic (TCP/UDP/DNS) through Tor using Linux network namespaces. Unlike proxychains, this works with Go/Rust/static binaries, prevents DNS leaks, and is impossible for applications to bypass. Includes…
لغة النص الأصلي: الإنجليزية
Set up and manage self-improving parallel reconnaissance agent triads — eternal overlapping waves of deep invasion, target expansion, and skill evolution. Covers the full lifecycle: spawning parallel subagents, cron orchestration, documentation structure,…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for car dealership and automotive retail websites — typically WordPress or custom PHP on shared hosting with inventory listings, financing applications, service booking, and OEM-branded portals. Built from a 20-target batch recon across…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for bakery, pastry shop, and cake shop websites — typically WordPress on shared hosting with e-commerce (WooCommerce, Shopify), online ordering for cakes/pastries, catering pages, and store locators. Common platforms include EatStreet,…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for craft brewery, brewpub, and distillery websites — common e-commerce platforms (Untappd, Shopify, WooCommerce), age-gate patterns, event calendars, beer menu APIs, and online ordering systems. Typically WordPress, Shopify, or custom…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for coffee shop, cafe, and tea house websites — typically WordPress on shared hosting with online ordering for pickup/delivery, loyalty/rewards programs, catering menus, and location/store finders. Common platforms include Toast POS,…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for car wash and auto detailing company websites — typically WordPress on shared hosting with membership plans, pricing menus, booking/scheduling tools, and customer account portals. Common platforms include EverWash, Washify, DRB…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for church/religious organization websites — WordPress on shared hosting with minimal security posture. Built from a 58-company mass recon dataset where church/religious org domains showed the highest rate of unpatched WordPress…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for daycare/childcare organization websites — typically WordPress or custom PHP on shared hosting with minimal security posture. Built from sector analysis showing daycare sites have high rates of unpatched CMS installs, exposed…
لغة النص الأصلي: الإنجليزية
Sector-specific recon for dentist, orthodontist, and dental practice websites — typically WordPress on shared hosting with online booking, patient portal integrations, and insurance verification pages. Common platforms include Dentrix Ascend, Eaglesoft, Open…
لغة النص الأصلي: الإنجليزية