Menu
SkillsMP has collected 47 skills from ankitsingh015/HuntMCP. Open a skill to review its source and details.
Showing 40 of 47 collected skills.
Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md…
CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers,…
Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus…
SSRF technique list covering IP-bypass encodings, cloud metadata endpoints (AWS/GCP/Azure/Alibaba/DigitalOcean), protocol smuggling, and common SSRF injection points (URL fetchers, image proxies, PDF generators, webhooks). Converted from…
XSS technique list covering reflected/stored/DOM/blind/mutation XSS, injection contexts, CSP bypass classes, postMessage leakage, and storage-based XSS via uploaded file formats. Converted from master-pentest-prompt.md Phase 9. Use when a parameter reflects…
A diagnostic decision tree for common curl/HTTP errors (connection failures, TLS, 400/401/403/429/500), a URL-parameter-to-test-priority lookup table, and persistence rules for how long to keep pushing on a target before moving on. Converted from…
How to start a HuntMCP engagement -- assessment mode selection, /goal focus mode, target fingerprinting, and the ROI-based testing order. Converted from master-pentest-prompt.md Phases 0.1/0.2/0.5/0.9. Use at the very start of an engagement, before any live…
The never-skip checklist of cheap, high-yield checks -- default credentials, installer leftovers, HTTP verb tampering, TRACE/XST, MIME-sniffing XSS, integer/type-confusion bypasses, unicode normalization tricks, cache deception/poisoning, and rate-limit gaps…
Systematic, tiered 403/WAF bypass decision guide plus common curl error diagnosis. Converted from master-pentest-prompt.md Phase 0.6. Use whenever a request comes back 403/blocked, or tool_resolver.classify_block() flags a WAF signature.
CI/CD pipeline and software-supply-chain attack techniques -- exposed CI secrets, poisoned pipeline execution (direct/indirect), self-hosted runner compromise, dependency confusion, typosquatting/install-script abuse, unsigned build artifacts, lockfile drift,…
Kubernetes-specific attack techniques -- anonymous API server access, RBAC misconfiguration, pod escape via privileged/hostPath/hostNetwork/mounted Docker socket, kubelet API abuse, etcd exposure, service-account token theft, ingress/admission-controller…
Race-condition / TOCTOU testing methodology -- the single-packet attack (last-byte sync) for minimizing network jitter, classic parallel-request racing, TOCTOU on non-identical request pairs, limit-overrun testing on withdrawals/coupons/OTP attempts, and…
Active Directory, Windows, and internal-network post-exploitation pivot techniques -- Kerberoasting/AS-REP roasting/pass-the-ticket/golden-silver tickets, NTLM relay and pass-the-hash, BloodHound path-to-DA analysis, ACL abuse, a default-port probe checklist…
OWASP API Security Top 10 as a dedicated API-only checklist -- BOLA, BFLA, broken object-property-level authz/mass assignment, unrestricted resource consumption, unsafe business-flow access, security misconfiguration, improper inventory management…
Structured autonomous-research methodology for when standard phases stop yielding findings -- six research loops (technology-driven, disclosed-report mining, research-blog learning, behavior-driven fuzzing, passive asset intelligence, business-logic/privilege…
How to map every finding to industry-standard frameworks for the final report -- MITRE ATT&CK tactic/technique IDs, PTES phase alignment, OWASP WSTG test-case numbering, CVSS 3.1 vector scoring, CWE IDs, and CISA KEV catalog cross-referencing. Converted from…
Mobile app (APK/IPA) testing checklist mapped to OWASP MASVS -- static decompilation for hardcoded secrets, Frida/objection cert-pinning bypass, deep-link and WebView JS-bridge hijacking, exported-component IPC abuse, backup/keystore extraction, root/frida…
OSINT and secret-hunting tactics -- Google/GitHub/paste dorking, favicon-hash Shodan pivots, source-code disclosure paths (.git/HEAD, .env, .DS_Store, backup files), Wayback URL mining, steganography in uploaded images, metadata leaks, and WHOIS-derived…
The standing background mandate that nothing gets skipped just because no phase or skill named it -- explore every discovered surface, follow every anomalous lead up to 4 levels deep, exploit rather than just note, invent new tests when no playbook matches,…
Per-CMS and per-framework attack checklists -- WordPress/Joomla/Drupal/Magento, backend frameworks (Laravel/Django/Spring Boot/Rails/PHP), and a long tail of other CMS/dev-tool products (Confluence, GitLab, Jenkins, Jira, SharePoint, phpMyAdmin, MediaWiki,…
Account-takeover techniques targeting the full identity lifecycle -- signup/verification bypass, email-change races, OAuth unlink/relink takeover, username collision via unicode/case normalization, role persistence in stale JWTs, orphaned-account…
Microservices and internal-API attack surface -- service-discovery endpoint enumeration (Consul/etcd/Eureka/Zipkin/Nacos), service-to-service JWT weaknesses, gRPC reflection/proto leaks, API gateway path-traversal/header-routing bypasses, exposed message…
Final gap-fill checklist of miscellaneous techniques that don't fit a single vuln-class skill -- OTP exposure patterns, feature-flag/beta-access toggles, multi-step flow step-skipping, "remember me" cookie forgery, image-proxy LFI, CSV/formula injection,…
Post-exploitation technique list once shell access is achieved -- reverse/bind shell one-liners across languages, interactive TTY upgrade, privilege escalation vectors (SUID/cron/capabilities/kernel CVEs/Docker), lateral movement, and egress/data-exfiltration…
XSSI (cross-site script inclusion) and client-side framework attack techniques -- JSONP hijacking, AngularJS sandbox escapes, Vue/React unsafe-HTML sinks, client-side prototype pollution gadgets, service-worker hijacking, Sass/SCSS server-side injection, and…
Conceptual mindset primers for reasoning about each major vuln class during live testing (SQLi, auth, info disclosure, access control, API testing, cache deception, request smuggling, Host header, JWT, SSTI, GraphQL, LLM) -- the "why" behind the payload, not…
Weak-crypto testing checklist -- CBC padding oracle attacks, ECB mode detection, predictable/reused IVs, hardcoded keys, weak password hashing, CBC bit-flipping, encrypted-ID-based IDOR, and timing side-channels in token comparison. Converted from…
HackTricks-level deep-cut techniques not covered by the mainstream vuln-class skills -- ESI/SSI injection, NTLM relay/coercion, SMTP header injection, JSONP hijacking, XS-Leak timing oracles, tabnabbing, DNS rebinding, exposed management interfaces…
The full PayloadsAllTheThings category checklist (60+ vuln classes) as a final coverage sweep. Converted from master-pentest-prompt.md Phase 22. Use as a closing checklist near the end of an engagement to catch any category that wasn't explicitly covered by…
CRLF injection into redirect params/Location/Set-Cookie/request URI, response-splitting to inject a rendered body, 302-splitting and hop-by-hop header abuse, and CRLF-driven request smuggling. Converted from master-pentest-prompt.md Phase 19. Use on any…
Open-redirect parameter names, common vulnerable locations (login, OAuth callback, password reset), bypass encodings, and the real-impact chain (open redirect -> OAuth token exfiltration -> account takeover). Converted from master-pentest-prompt.md Phase 18.…
Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and…
Low-to-advanced encoding cheat sheet for evading WAFs and input filters -- HTML/JS/CSS/unicode escapes, SQL whitespace/comment tricks, XSS event-handler and mXSS vectors, PHP upload-filter bypasses, path confusion, homoglyphs, chunked-smuggling-past-WAF, and…
Authentication and session-management technique list (brute-force rate-limit bypass, JWT, OAuth/OIDC, SAML/SSO, session fixation, password reset, MFA bypass) plus 2025-26 modern identity attacks (passkey/WebAuthn, OAuth device-code phishing, AiTM relay, ghost…
Denial-of-service and resilience testing techniques -- rate-limit batching bypass, ReDoS, unbounded input, decompression bombs, HPP-based DoS, and resource-exhaustion probing. Converted from master-pentest-prompt.md Phase 15. Use to check whether rate limits…
Email-domain security checklist -- SPF/DMARC/DKIM misconfiguration detection, open-relay/contact-form spoofing, ARC laundering, and third-party mail-gateway SPF re-evaluation gaps. Converted from master-pentest-prompt.md Phase 16, explicitly flagged in the…
Modern/emerging attack surface -- AI/LLM (OWASP LLM Top 10, a practical prompt-injection probing loop, and 2026-era AI-toolchain/supply-chain attacks like agent-harness config poisoning and rogue MCP servers), prototype pollution, dependency/supply-chain…
General manual-testing mindset and reasoning "engines" (memory, response-analysis, attack-chaining, payload-mutation, application-mapping, data-flow, role-comparison, anomaly-detection) that apply across every vuln class, not just one. Converted from…
Version-control and backup exposure (.git/.svn/.hg dumps), API/debug endpoint leaks (Swagger, source maps, actuator heapdumps), cloud metadata and datastore exposure (AWS/GCP/Firebase/Mongo/Redis/Elasticsearch), secrets scanning, and user/UUID enumeration…
HTTP/2/3 protocol attacks, TLS/security-header audits, WebSocket transport issues, cache poisoning/deception, exposed container/orchestration surfaces (K8s/Docker), serverless misconfig, and log-poisoning-to-RCE. Converted from master-pentest-prompt.md Phase…