Guides AI and LLM application security testing including prompt injection, system prompt extraction, tool/function abuse, MCP server testing, and data exfiltration via LLM features. Use for chatbots, agents, and AI-integrated apps.
Guides binary exploitation including stack overflow, ROP, format strings, heap basics, pwntools, and GDB analysis. Use when engagement ROE explicitly authorizes custom exploit development beyond Metasploit modules.
Guides blockchain and smart contract security testing with reentrancy, flash loan, and access control analysis using Slither and EVM tooling. Use when auditing Solidity contracts, DeFi protocols, EVM dApps, or Web3 signing workflows in engagement scope.
Guides cloud penetration testing for AWS, Azure, and GCP enumeration, credential abuse, metadata SSRF, storage misconfigurations, IAM privilege escalation, and cloud lateral movement from web or internal footholds.
Guides OS command injection testing with shell metacharacter probes, blind exfiltration, filter bypass, and OS-specific syntax. Use when inputs reach shell commands such as ping, nslookup, file conversion, or when shell metacharacters alter application…
Guides container and DevOps penetration testing for Docker escape, Kubernetes abuse, CI/CD pipeline secrets, package manager poisoning, and secrets enumeration from footholds or exposed services.
Guides database penetration testing for MSSQL, MySQL, PostgreSQL, MongoDB, Redis, and Elasticsearch. Use when database ports are open, SQL injection yields DB access, or linked-server abuse is suspected.
Guides insecure deserialization testing with format identification, language-specific gadget chains, and ysoserial/phpggc tooling. Use when Java, .NET, PHP, Python, or Ruby serialized objects appear in cookies, headers, APIs, or base64-encoded parameters…