Zyrexnn/Cybermes - Page 3

oast-blind-testing

Generates Out-of-Band (OAST) interaction payloads with interactsh-client to detect and confirm Blind SSRF, Blind RCE, and Out-of-Band data leakage.

parameter-mining

Discovers hidden GET/POST/JSON parameters from web applications and categorizes them for IDOR, SSRF, SQLi, and redirect testing.

penetration-testing-with-strix

Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead…

recon

Orchestrates scoped subdomain enumeration, DNS resolution, and active web probing for bug bounty targets.

source-code-audit

Performs whitebox static application security testing (SAST), code review, API route extraction, credential hunting, and vulnerability pattern detection in local repositories or GitHub codebases.

vulnerability-analysis

Analyzes scan results and code flaws, formulates security hypotheses, generates deterministic PoCs, and eliminates false positives following the "No PoC, No Finding" standard.

waf-bypass-and-exploitation

Applies URL encoding, header tampering, path normalization, and payload mutation to bypass Web Application Firewalls (WAF) when testing valid vulnerabilities.

web-enumeration

Discovers web application endpoints, Javascript files, hidden paths, and technology fingerprints using httpx and katana.

new-api-pentest

Authorized bug-bounty / web-pentest methodology for New API (and One API fork) AI-gateway deployments, including their storefront (Midtrans) and LibreChat chat-GUI ecosystem. Covers endpoint mining, known patched decoys, access-control verification, and the…

web-pentest

Master orchestrator skill for end-to-end authorized web application penetration testing, mapping OWASP Top 10 vulnerabilities, coordinating specialized sub-skills, source code auditing, browser automation, and deterministic PoC reporting.