Menu
Skills in this repository
SkillsMP has collected 100 skills from NoorQureshi/SploitAgent. Open a skill to review its source and details.
NoorQureshi/SploitAgentShowing 20 of 100 collected skills.
Host header injection — abuse a trusted Host/X-Forwarded-Host to poison password-reset links, routing, and caches. Load when the app builds absolute URLs from the request host, on password-reset flows, or behind a proxy/CDN. Signals: reset emails with links,…
Insecure Direct Object Reference / broken access control on web objects. Load when a request references an object by id you can change: /account/1234, ?invoice=987, UUIDs in URLs/bodies, "download", "view", "edit" endpoints, numeric or guessable identifiers,…
Local File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../`…
Attack OAuth 2.0 / OIDC / SSO flows for account takeover. Load on "Login with Google/GitHub", /authorize, /callback, redirect_uri, state, code/token params, SAML/OIDC SSO. Signals: OAuth endpoints, redirect_uri handling, missing state, implicit flow,…
Open redirect — abuse a redirect param to send users to attacker sites, and chain it (OAuth token theft, SSRF filter bypass, phishing). Load on params like redirect=, next=, url=, return=, callback=, dest=, or a 30x Location built from input. Signals:…
JavaScript prototype pollution (client & server) → XSS, auth bypass, RCE via gadgets. Load on Node.js/JS apps that merge user objects: query/JSON parsing, `Object.assign`/deep-merge, lodash/jQuery.extend, config merges. Signals: __proto__,…
Exploit race conditions / TOCTOU — fire concurrent requests to break single-use limits. Load on "limit-once" actions: coupon/gift-card redemption, withdrawals, votes, invites, MFA/OTP attempts, balance changes. Signals: check-then-act on shared state,…
Bypass rate limits and anti-automation to enable brute force, OTP guessing, coupon abuse, and enumeration. Load when an endpoint is throttled (429/"too many attempts"), on login/OTP/reset, or "rate limit". Signals: 429 responses, lockout messages, per-account…
HTTP request smuggling (CL.TE/TE.CL/TE.TE/CL.0) — desync front-end and back-end to poison other users' requests. Load behind a proxy/CDN/load-balancer, on "smuggling/desync", or when Content-Length vs Transfer-Encoding handling differs. Signals: front-end +…
Attack SAML SSO — signature exclusion/wrapping (XSW), unsigned assertions, and comment/XXE tricks to forge authentication. Load on SAML SSO (SAMLResponse, ACS URL, IdP/SP), enterprise login, or "SAML". Signals: SAMLResponse base64 in POST, /saml/acs,…
Detect and exploit SQL injection (error-based, UNION, boolean/time blind, stacked). Load when a param feeds a query, you see DB errors, numeric/string params change result sets, login forms, search, sort/order-by, or ORM raw queries. Signals: "id=", 500 on a…
Turn a server-side request (SSRF) into RCE by speaking the Redis protocol over gopher:// to an internal, unauthenticated Redis — write a cron job, an SSH key, or a webshell. Load when: SSRF is confirmed (URL fetch, webhook, PDF/URL preview, image proxy) AND…
Discover and escalate Server-Side Request Forgery. Load when the app fetches a URL you influence: webhooks, "import from URL", link/image preview, PDF/HTML render, avatar-by-URL, URL health-checks, XML/SVG parsers. Signals: params like url=, uri=, dest=,…
Server-Side Template Injection → RCE. Load when user input is rendered by a template engine: profile names in emails, custom reports, "hello {{name}}", error pages echoing math, Jinja2/Twig/Freemarker/Velocity/ERB/Handlebars. Signals: {{7*7}} returns 49,…
Claim a dangling DNS record pointing to a deprovisioned service (subdomain takeover). Load after subdomain enum, on CNAMEs to cloud services, "NoSuchBucket"/"404 there isn't a GitHub Pages site here", or dangling A/CNAME. Signals: CNAME →…
A fast, ordered checklist for testing a web application end to end — so nothing gets skipped. Load when starting on a web target, "checklist", "what should I test", methodology triage, or to confirm coverage before reporting. Signals: a new web app in scope,…
Register and authenticate against a WebAuthn/FIDO2 relying party using a self-built SOFTWARE authenticator (no hardware key) when the RP requests attestation "none" (or otherwise doesn't verify attestation trust). Load when: a login is "WebAuthn/passkey/…
Attack WebSocket endpoints — CSWSH (cross-site hijacking), message tampering, and auth gaps. Load on ws:// or wss:// connections, Socket.IO, real-time chat/notifications/trading, or "websocket". Signals: Upgrade: websocket, ws handshake, JSON messages over a…
Find and prove Cross-Site Scripting (reflected, stored, DOM). Load when input is echoed into HTML/JS/attributes, a search/comment/profile field renders your text, a URL param appears in the response, or a sink like innerHTML/document.write is in client JS.…
XML External Entity injection → file read, SSRF, sometimes RCE. Load when the app parses XML you supply: SOAP, SAML, XML APIs, SVG/DOCX/XLSX upload, RSS import, `Content-Type: application/xml`. Signals: XML request bodies, "<?xml", SAML responses, file…