misc-deep-cuts

Final gap-fill checklist of miscellaneous techniques that don't fit a single vuln-class skill -- OTP exposure patterns, feature-flag/beta-access toggles, multi-step flow step-skipping, "remember me" cookie forgery, image-proxy LFI, CSV/formula injection, PDF-generator SSRF, header-based admin spoofing, filename-based attacks, and referral/coupon abuse. Converted from master-pentest-prompt.md Phase 28. Use as a final pass after the mainstream vuln-class skills, catching real-world bugs that don't slot neatly into one category.

Ir a la instalación

Repositorio: ankitsingh015/HuntMCP
Última actividad en el origen: 24 de agosto de 2026 a las 12:34
Idioma detectado de SKILL.md: inglés
Estrellas: 4
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill misc-deep-cuts

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

Ver todos los de este repositorio

Misc deep cuts -- final gap fill

When to use

A final pass after the mainstream vuln-class skills -- these are real, recurring bug patterns that just don't map cleanly onto a single category, so they're easy to skip if testing is purely checklist-driven by vuln class.

Checklist

OTP exposure: the OTP returned directly in the response body, an OTP embedded in a URL, or an OTP predictable from a timestamp (including backup codes shown in a response where they shouldn't be).

Feature flag / beta access: toggling X-Feature-Flags, X-Enable-Beta, ?beta=1, ?internal=1 -- these can reveal hidden admin routes that were only ever "hidden," never actually access-controlled.

Step-skip logic: in a multi-step flow (signup -> verify -> payment), POST directly to a later step, reorder the steps, replay a step, or skip whatever CSRF protection only the last step has.

"Remember me" persistent cookie: if the token is a base64/JSON blob rather than an opaque session ID, decrypting or just decoding it can lead straight to session takeover, especially with weak entropy.

Avatar/image URL endpoints: an image proxy that reads a user-supplied URL/path can become an LFI vector, not just SSRF (see the ssrf skill for the URL-fetching side of this).

CSV/Excel export injection: formula injection (=, +, -, @ prefixes triggering DDE/command execution) in exported spreadsheet data an admin later opens.

Print/PDF generators: SSRF via externally-loaded images in the rendered document, HTML injection into a server-side-rendered PDF, RCE through the rendering engine/font-handling layer itself.

Header-based admin detection: X-Admin, X-User, X-Role headers that the backend trusts if simply forged by the client.

Filename-based attacks: CRLF or ../ inside a filename parameter -- can produce stored XSS on download or path traversal via the filename itself, not just the file content.

Large file / decompression bombs: zip bombs, PDF bombs -- see the dos-and-resilience skill for the broader DoS technique list.

GraphQL loose ends: field suggestion left enabled, __typename leaking schema info, unbounded mutation complexity, WebSocket subscriptions with no auth check (see deep-cut-surfaces for the broader GraphQL/WebSocket list).

Email verification bypass: changing the verification target to an attacker-owned email mid-flow, using a verification link with the attacker's own email against a victim's account, or an IDOR in the email-template's own ID parameter.

Referral/program abuse: self-referrals, coupon stacking, invite- bonus farming through repeated fake signups.

API documentation exposure: /swagger-ui, /redoc, /api-docs, a live /graphql playground, /v3/api-docs -- these map the entire API surface for free once found.