Menú
SkillsMP ha recopilado 47 skills de ankitsingh015/HuntMCP. Abre una skill para revisar su origen y sus detalles.
Mostrando 40 de 47 skills recopiladas.
Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md…
Idioma del texto original: inglés
CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers,…
Idioma del texto original: inglés
Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus…
Idioma del texto original: inglés
SSRF technique list covering IP-bypass encodings, cloud metadata endpoints (AWS/GCP/Azure/Alibaba/DigitalOcean), protocol smuggling, and common SSRF injection points (URL fetchers, image proxies, PDF generators, webhooks). Converted from…
Idioma del texto original: inglés
XSS technique list covering reflected/stored/DOM/blind/mutation XSS, injection contexts, CSP bypass classes, postMessage leakage, and storage-based XSS via uploaded file formats. Converted from master-pentest-prompt.md Phase 9. Use when a parameter reflects…
Idioma del texto original: inglés
A diagnostic decision tree for common curl/HTTP errors (connection failures, TLS, 400/401/403/429/500), a URL-parameter-to-test-priority lookup table, and persistence rules for how long to keep pushing on a target before moving on. Converted from…
Idioma del texto original: inglés
How to start a HuntMCP engagement -- assessment mode selection, /goal focus mode, target fingerprinting, and the ROI-based testing order. Converted from master-pentest-prompt.md Phases 0.1/0.2/0.5/0.9. Use at the very start of an engagement, before any live…
Idioma del texto original: inglés
The never-skip checklist of cheap, high-yield checks -- default credentials, installer leftovers, HTTP verb tampering, TRACE/XST, MIME-sniffing XSS, integer/type-confusion bypasses, unicode normalization tricks, cache deception/poisoning, and rate-limit gaps…
Idioma del texto original: inglés
Systematic, tiered 403/WAF bypass decision guide plus common curl error diagnosis. Converted from master-pentest-prompt.md Phase 0.6. Use whenever a request comes back 403/blocked, or tool_resolver.classify_block() flags a WAF signature.
Idioma del texto original: inglés
CI/CD pipeline and software-supply-chain attack techniques -- exposed CI secrets, poisoned pipeline execution (direct/indirect), self-hosted runner compromise, dependency confusion, typosquatting/install-script abuse, unsigned build artifacts, lockfile drift,…
Idioma del texto original: inglés
Kubernetes-specific attack techniques -- anonymous API server access, RBAC misconfiguration, pod escape via privileged/hostPath/hostNetwork/mounted Docker socket, kubelet API abuse, etcd exposure, service-account token theft, ingress/admission-controller…
Idioma del texto original: inglés
Race-condition / TOCTOU testing methodology -- the single-packet attack (last-byte sync) for minimizing network jitter, classic parallel-request racing, TOCTOU on non-identical request pairs, limit-overrun testing on withdrawals/coupons/OTP attempts, and…
Idioma del texto original: inglés
Active Directory, Windows, and internal-network post-exploitation pivot techniques -- Kerberoasting/AS-REP roasting/pass-the-ticket/golden-silver tickets, NTLM relay and pass-the-hash, BloodHound path-to-DA analysis, ACL abuse, a default-port probe checklist…
Idioma del texto original: inglés
OWASP API Security Top 10 as a dedicated API-only checklist -- BOLA, BFLA, broken object-property-level authz/mass assignment, unrestricted resource consumption, unsafe business-flow access, security misconfiguration, improper inventory management…
Idioma del texto original: inglés
Structured autonomous-research methodology for when standard phases stop yielding findings -- six research loops (technology-driven, disclosed-report mining, research-blog learning, behavior-driven fuzzing, passive asset intelligence, business-logic/privilege…
Idioma del texto original: inglés
How to map every finding to industry-standard frameworks for the final report -- MITRE ATT&CK tactic/technique IDs, PTES phase alignment, OWASP WSTG test-case numbering, CVSS 3.1 vector scoring, CWE IDs, and CISA KEV catalog cross-referencing. Converted from…
Idioma del texto original: inglés
Mobile app (APK/IPA) testing checklist mapped to OWASP MASVS -- static decompilation for hardcoded secrets, Frida/objection cert-pinning bypass, deep-link and WebView JS-bridge hijacking, exported-component IPC abuse, backup/keystore extraction, root/frida…
Idioma del texto original: inglés
OSINT and secret-hunting tactics -- Google/GitHub/paste dorking, favicon-hash Shodan pivots, source-code disclosure paths (.git/HEAD, .env, .DS_Store, backup files), Wayback URL mining, steganography in uploaded images, metadata leaks, and WHOIS-derived…
Idioma del texto original: inglés
The standing background mandate that nothing gets skipped just because no phase or skill named it -- explore every discovered surface, follow every anomalous lead up to 4 levels deep, exploit rather than just note, invent new tests when no playbook matches,…
Idioma del texto original: inglés
Per-CMS and per-framework attack checklists -- WordPress/Joomla/Drupal/Magento, backend frameworks (Laravel/Django/Spring Boot/Rails/PHP), and a long tail of other CMS/dev-tool products (Confluence, GitLab, Jenkins, Jira, SharePoint, phpMyAdmin, MediaWiki,…
Idioma del texto original: inglés
Account-takeover techniques targeting the full identity lifecycle -- signup/verification bypass, email-change races, OAuth unlink/relink takeover, username collision via unicode/case normalization, role persistence in stale JWTs, orphaned-account…
Idioma del texto original: inglés
Microservices and internal-API attack surface -- service-discovery endpoint enumeration (Consul/etcd/Eureka/Zipkin/Nacos), service-to-service JWT weaknesses, gRPC reflection/proto leaks, API gateway path-traversal/header-routing bypasses, exposed message…
Idioma del texto original: inglés
Final gap-fill checklist of miscellaneous techniques that don't fit a single vuln-class skill -- OTP exposure patterns, feature-flag/beta-access toggles, multi-step flow step-skipping, "remember me" cookie forgery, image-proxy LFI, CSV/formula injection,…
Idioma del texto original: inglés
Post-exploitation technique list once shell access is achieved -- reverse/bind shell one-liners across languages, interactive TTY upgrade, privilege escalation vectors (SUID/cron/capabilities/kernel CVEs/Docker), lateral movement, and egress/data-exfiltration…
Idioma del texto original: inglés
XSSI (cross-site script inclusion) and client-side framework attack techniques -- JSONP hijacking, AngularJS sandbox escapes, Vue/React unsafe-HTML sinks, client-side prototype pollution gadgets, service-worker hijacking, Sass/SCSS server-side injection, and…
Idioma del texto original: inglés
Conceptual mindset primers for reasoning about each major vuln class during live testing (SQLi, auth, info disclosure, access control, API testing, cache deception, request smuggling, Host header, JWT, SSTI, GraphQL, LLM) -- the "why" behind the payload, not…
Idioma del texto original: inglés
Weak-crypto testing checklist -- CBC padding oracle attacks, ECB mode detection, predictable/reused IVs, hardcoded keys, weak password hashing, CBC bit-flipping, encrypted-ID-based IDOR, and timing side-channels in token comparison. Converted from…
Idioma del texto original: inglés
HackTricks-level deep-cut techniques not covered by the mainstream vuln-class skills -- ESI/SSI injection, NTLM relay/coercion, SMTP header injection, JSONP hijacking, XS-Leak timing oracles, tabnabbing, DNS rebinding, exposed management interfaces…
Idioma del texto original: inglés
The full PayloadsAllTheThings category checklist (60+ vuln classes) as a final coverage sweep. Converted from master-pentest-prompt.md Phase 22. Use as a closing checklist near the end of an engagement to catch any category that wasn't explicitly covered by…
Idioma del texto original: inglés
CRLF injection into redirect params/Location/Set-Cookie/request URI, response-splitting to inject a rendered body, 302-splitting and hop-by-hop header abuse, and CRLF-driven request smuggling. Converted from master-pentest-prompt.md Phase 19. Use on any…
Idioma del texto original: inglés
Open-redirect parameter names, common vulnerable locations (login, OAuth callback, password reset), bypass encodings, and the real-impact chain (open redirect -> OAuth token exfiltration -> account takeover). Converted from master-pentest-prompt.md Phase 18.…
Idioma del texto original: inglés
Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and…
Idioma del texto original: inglés
Low-to-advanced encoding cheat sheet for evading WAFs and input filters -- HTML/JS/CSS/unicode escapes, SQL whitespace/comment tricks, XSS event-handler and mXSS vectors, PHP upload-filter bypasses, path confusion, homoglyphs, chunked-smuggling-past-WAF, and…
Idioma del texto original: inglés
Authentication and session-management technique list (brute-force rate-limit bypass, JWT, OAuth/OIDC, SAML/SSO, session fixation, password reset, MFA bypass) plus 2025-26 modern identity attacks (passkey/WebAuthn, OAuth device-code phishing, AiTM relay, ghost…
Idioma del texto original: inglés
Denial-of-service and resilience testing techniques -- rate-limit batching bypass, ReDoS, unbounded input, decompression bombs, HPP-based DoS, and resource-exhaustion probing. Converted from master-pentest-prompt.md Phase 15. Use to check whether rate limits…
Idioma del texto original: inglés
Email-domain security checklist -- SPF/DMARC/DKIM misconfiguration detection, open-relay/contact-form spoofing, ARC laundering, and third-party mail-gateway SPF re-evaluation gaps. Converted from master-pentest-prompt.md Phase 16, explicitly flagged in the…
Idioma del texto original: inglés
Modern/emerging attack surface -- AI/LLM (OWASP LLM Top 10, a practical prompt-injection probing loop, and 2026-era AI-toolchain/supply-chain attacks like agent-harness config poisoning and rogue MCP servers), prototype pollution, dependency/supply-chain…
Idioma del texto original: inglés
General manual-testing mindset and reasoning "engines" (memory, response-analysis, attack-chaining, payload-mutation, application-mapping, data-flow, role-comparison, anomaly-detection) that apply across every vuln class, not just one. Converted from…
Idioma del texto original: inglés
Version-control and backup exposure (.git/.svn/.hg dumps), API/debug endpoint leaks (Swagger, source maps, actuator heapdumps), cloud metadata and datastore exposure (AWS/GCP/Firebase/Mongo/Redis/Elasticsearch), secrets scanning, and user/UUID enumeration…
Idioma del texto original: inglés
HTTP/2/3 protocol attacks, TLS/security-header audits, WebSocket transport issues, cache poisoning/deception, exposed container/orchestration surfaces (K8s/Docker), serverless misconfig, and log-poisoning-to-RCE. Converted from master-pentest-prompt.md Phase…
Idioma del texto original: inglés