Menú
Skills en este repositorio
SkillsMP ha recopilado 145 skills de uphiago/recon-skills. Abre una skill para revisar su origen y sus detalles.
uphiago/recon-skillsMostrando 40 de 145 skills recopiladas.
Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives…
Idioma del texto original: inglés
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset…
Idioma del texto original: inglés
Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different…
Idioma del texto original: inglés
High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated
Idioma del texto original: inglés
7-phase pentest pipeline from passive recon to exploitation.
Idioma del texto original: inglés
Poison CDN cache or deceive when X-Cache header is detected.
Idioma del texto original: inglés
Identify CMS, frameworks, and server technology stacks on live hosts.
Idioma del texto original: inglés
Exploit WP CORS credential reflection for data theft.
Idioma del texto original: inglés
DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis
Idioma del texto original: inglés
Find leaked API keys, tokens, and credentials in public GitHub repositories.
Idioma del texto original: inglés
Detect hardcoded passwords in HTML forms, JavaScript, and API responses.
Idioma del texto original: inglés
Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
Idioma del texto original: inglés
Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.
Idioma del texto original: inglés
Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
Idioma del texto original: inglés
Exploit public bucket Content-Type override for stored XSS on target origin.
Idioma del texto original: inglés
Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
Idioma del texto original: inglés
Mass scan for exposed env files, backups, and git configs.
Idioma del texto original: inglés
Launch stealth Chromium with C++ fingerprint patches for anti-bot bypass.
Idioma del texto original: inglés
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
Idioma del texto original: inglés
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
Idioma del texto original: inglés
Exploit unauthenticated multi-step API flows without credentials.
Idioma del texto original: inglés
Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
Idioma del texto original: inglés
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation…
Idioma del texto original: inglés
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause…
Idioma del texto original: inglés
GCP/AWS/Azure cloud exploitation -- Cloud Functions, Firestore, Cloud Run, S3, MinIO, Blob Storage, SA keys
Idioma del texto original: inglés
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix…
Idioma del texto original: inglés
Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC…
Idioma del texto original: inglés
Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl…
Idioma del texto original: inglés
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link…
Idioma del texto original: inglés
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain…
Idioma del texto original: inglés
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA,…
Idioma del texto original: inglés
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow…
Idioma del texto original: inglés
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception…
Idioma del texto original: inglés
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI…
Idioma del texto original: inglés
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled…
Idioma del texto original: inglés
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP…
Idioma del texto original: inglés
Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors →…
Idioma del texto original: inglés
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte…
Idioma del texto original: inglés
Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument,…
Idioma del texto original: inglés
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway…
Idioma del texto original: inglés