Menü
SkillsMP hat 145 Skills aus uphiago/recon-skills gesammelt. Öffne einen Skill, um Quelle und Details zu prüfen.
Es werden 40 von 145 gesammelten Skills angezeigt.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Quellsprache: Englisch
Attack SAML SSO via XSW, signature strip, metadata extract.
Quellsprache: Englisch
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Quellsprache: Englisch
Use when verified WordPress findings may combine into an authorized path to administrative or server control.
Quellsprache: Englisch
Escape Docker containers to host root via 5 techniques.
Quellsprache: Englisch
Use when classifying a verified web or WordPress behavior and selecting a related validation skill.
Quellsprache: Englisch
Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.
Quellsprache: Englisch
Use when starting or restructuring an authorized external web and API assessment.
Quellsprache: Englisch
Use when an API may expose data or privileged operations without authentication.
Quellsprache: Englisch
Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
Quellsprache: Englisch
Mine error_log for creds, paths, SQL when leak hunt finds.
Quellsprache: Englisch
Exchange/OWA NTLM AD leak, spray attack when mail subdomain.
Quellsprache: Englisch
Exploit Firebase/Supabase for data via JS config leak probe.
Quellsprache: Englisch
Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
Quellsprache: Englisch
Mine GitLab for secrets, CI tokens when subdomain found.
Quellsprache: Englisch
Attack cameras via RTSP, ONVIF, Axis config when 554 open.
Quellsprache: Englisch
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
Quellsprache: Englisch
Decode, forge, brute JWTs when Bearer auth header is seen.
Quellsprache: Englisch
Chain phpinfo to RCE via exec check when info.php exposed.
Quellsprache: Englisch
Port scan /8-/24 with Masscan+RustScan and nmap banners.
Quellsprache: Englisch
Nmap scan for MySQL, Redis, FTP, SSH, internal API services.
Quellsprache: Englisch
Hunt staging via crt.sh when production is WAF-hardened.
Quellsprache: Englisch
Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
Quellsprache: Englisch
Hunt WP plugins via REST, exploit CVEs when version known.
Quellsprache: Englisch
Batch WP recon: users, CORS, XMLRPC, leaks across domains.
Quellsprache: Englisch
Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification,…
Quellsprache: Englisch
Exploit XMLRPC multicall, pingback for brute force and SSRF.
Quellsprache: Englisch
Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.
Quellsprache: Englisch
Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.
Quellsprache: Englisch
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails,…
Quellsprache: Englisch
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…
Quellsprache: Englisch
Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.
Quellsprache: Englisch
Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.
Quellsprache: Englisch
Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals), filter against existing test coverage, probe alive domains, and run the full testing pipeline across 20+…
Quellsprache: Englisch
Parameterized sector recon using sector database.
Quellsprache: Englisch
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use…
Quellsprache: Englisch
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain…
Quellsprache: Englisch
Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.
Quellsprache: Englisch
Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version extraction from multiple sources (readme.txt, assets, inline JS), CVE database cross-referencing with WPScan/Patchstack/NVD/NVD API,…
Quellsprache: Englisch
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…
Quellsprache: Englisch