Menu
Skills dans ce dépôt
SkillsMP a collecté 908 skills depuis abelrguezr/hacktricks-skills. Ouvrez un skill pour examiner sa source et ses détails.
abelrguezr/hacktricks-skillsAffichage de 40 skills collectés sur 908.
Test for Go HTTP CONNECT method path normalization bypass vulnerabilities. Use this skill when analyzing Go web applications for path traversal issues, when investigating HTTP CONNECT method handling, or when security testing Go-based servers. This skill…
Langue du texte source : anglais
Pentest Grafana instances for misconfigurations and CVE-2024-9264 SQL Expressions RCE/LFI vulnerability. Use this skill whenever you need to assess Grafana security, check for exposed credentials in config files, enumerate data sources, or test for the…
Langue du texte source : anglais
Security testing for GraphQL endpoints. Use this skill whenever you need to test GraphQL APIs for vulnerabilities, enumerate schemas, detect exposed endpoints, or assess security configurations. Trigger this skill for any GraphQL security assessment,…
Langue du texte source : anglais
H2 Java SQL database pentesting and exploitation. Use this skill whenever the user mentions H2 database, Java SQL database vulnerabilities, database SQL injection to RCE, unauthenticated database access, or any scenario involving H2 database exploitation.…
Langue du texte source : anglais
IIS (Internet Information Services) pentesting and exploitation. Use this skill whenever the user mentions IIS, Microsoft web servers, ASPX, ASP.NET, .NET applications, web.config, trace.axd, Telerik, or any Microsoft Windows web server testing. This skill…
Langue du texte source : anglais
Configure and audit ImageMagick security policies to prevent RCE and DoS vulnerabilities. Use this skill whenever you need to secure ImageMagick installations, review policy.xml files, harden image processing services, or investigate ImageMagick-related…
Langue du texte source : anglais
How to exploit CVE-2023-46818 and related vulnerabilities in ISPConfig hosting control panels. Use this skill whenever the user mentions ISPConfig, hosting control panel pentesting, CVE-2023-46818, language editor exploitation, or needs to test for PHP code…
Langue du texte source : anglais
Security assessment and enumeration of JBoss application servers. Use this skill whenever the user mentions JBoss, JBoss AS, JBoss EAP, or needs to enumerate Java application servers, check for default credentials, find exposed management consoles, or assess…
Langue du texte source : anglais
Security assessment and penetration testing for Jira and Confluence instances. Use this skill whenever the user needs to enumerate Jira/Confluence privileges, test for known vulnerabilities (CVE-2023-22527, CVE-2023-22515, CVE-2024-21683), assess plugin…
Langue du texte source : anglais
Pentest Joomla CMS installations. Use this skill whenever the user mentions Joomla, wants to enumerate a Joomla site, check for Joomla vulnerabilities, perform brute-force attacks on Joomla, exploit Joomla RCE vulnerabilities, or assess Joomla security.…
Langue du texte source : anglais
How to exploit JSP getContextPath() vulnerabilities for XSS and link manipulation attacks. Use this skill whenever you're pentesting Java web applications with JSP files, when you find JSP endpoints that might be vulnerable to context path manipulation, or…
Langue du texte source : anglais
Laravel application security testing and exploitation. Use this skill whenever the user mentions Laravel, PHP web application pentesting, APP_KEY exploitation, cookie decryption, deserialization attacks, or any Laravel-specific vulnerability research. This…
Langue du texte source : anglais
How to enumerate, exploit, and post-exploit Microsoft SharePoint environments. Use this skill whenever the user mentions SharePoint, IIS, ASP.NET web applications, ViewState exploitation, or needs to assess SharePoint security. Make sure to use this skill for…
Langue du texte source : anglais
Security assessment and penetration testing for Moodle learning management systems. Use this skill whenever the user mentions Moodle, LMS security, educational platform pentesting, or needs to assess Moodle installations for vulnerabilities. Trigger for any…
Langue du texte source : anglais
Pentest Next.js applications for security vulnerabilities. Use this skill whenever the user mentions Next.js security testing, Next.js pentesting, Next.js vulnerability assessment, React Server Components, Server Actions, middleware bypass, or any…
Langue du texte source : anglais
Audit and test Nginx servers for common misconfigurations and vulnerabilities. Use this skill whenever you need to assess Nginx security, check for LFI vulnerabilities, test for HTTP request splitting, analyze proxy configurations, or identify dangerous…
Langue du texte source : anglais
Pentest NodeJS Express.js applications by testing and cracking cookie signatures. Use this skill whenever you need to test Express.js cookie secrets, sign/verify cookies, or perform cookie-based authentication bypass testing. Trigger this skill for any web…
Langue du texte source : anglais
Web application penetration testing methodology. Use this skill whenever the user needs to assess web applications for security vulnerabilities, enumerate web services, identify technologies, discover hidden endpoints, or perform security testing on…
Langue du texte source : anglais
Use this skill whenever analyzing Perl code for command injection vulnerabilities, especially in Apache mod_perl handlers, web applications with Perl backends, or when hunting for RCE through shell execution sinks like backticks, qx//, system(), or open()…
Langue du texte source : anglais
PHP pentesting skill for exploiting arbitrary object instantiation vulnerabilities (new $_GET["a"]($_GET["b"])) to achieve Remote Code Execution. Use this skill whenever you encounter PHP code with dynamic class instantiation, user-controlled class names, or…
Langue du texte source : anglais
How to identify and test for PHP Server-Side Request Forgery (SSRF) vulnerabilities. Use this skill whenever the user mentions PHP, SSRF, server-side request forgery, file_get_contents, WordPress remote functions, CRLF injection, or needs to test for…
Langue du texte source : anglais
PHP security testing and exploitation techniques. Use this skill whenever the user needs to test PHP applications for vulnerabilities, analyze PHP code for security issues, generate PHP payloads, understand PHP type juggling attacks, or perform web…
Langue du texte source : anglais
Audit PHP configurations for security vulnerabilities and hardening opportunities. Use this skill whenever you need to review PHP security settings, check for dangerous enabled functions, assess disable_functions configuration, verify extension_dir security,…
Langue du texte source : anglais
Security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities to bypass PHP disable_functions restrictions. Use this skill whenever the user mentions PHP security testing, disable_functions bypass, ImageMagick vulnerabilities,…
Langue du texte source : anglais
Bypass PHP disable_functions restrictions using mod_cgi CGI handler. Use this skill when testing PHP applications for command execution vulnerabilities, when PHP functions like system/exec are disabled but you have write access and mod_cgi is enabled, or when…
Langue du texte source : anglais
Bypass disabled_functions in PHP 4 >= 4.2.0 and PHP 5 using pcntl_exec. Use this skill when testing PHP applications for command execution vulnerabilities, analyzing disabled_functions configurations, or when you need to execute system commands through PHP…
Langue du texte source : anglais
How to test for PHP disable_functions and safe_mode bypass vulnerabilities during authorized penetration testing. Use this skill whenever you need to assess PHP security configurations, test for function restriction bypasses, or evaluate PHP hardening…
Langue du texte source : anglais
How to bypass PHP safe_mode and open_basedir restrictions using cURL on legacy PHP 5.2.4/5.2.5 (CVE-2007-4850). Use this skill whenever you need to read arbitrary files from a PHP server with restricted file access, especially in CTFs or legacy systems.…
Langue du texte source : anglais
Bypass PHP disable_functions restrictions using stream wrapper exploits. Use this skill when testing PHP applications for security vulnerabilities, specifically when you encounter disabled functions like fopen, file_get_contents, or similar file operations.…
Langue du texte source : anglais
Bypass PHP disable_functions restriction using the debug_backtrace() UAF vulnerability (PHP 7.0-7.4, *nix only). Use this skill when you need to execute system commands in PHP environments where functions like system(), exec(), shell_exec() are disabled. This…
Langue du texte source : anglais
How to bypass PHP disable_functions and open_basedir restrictions using PHP-FPM FastCGI protocol vulnerabilities. Use this skill whenever the user mentions PHP-FPM, FastCGI, disable_functions bypass, open_basedir bypass, PHP configuration injection, or needs…
Langue du texte source : anglais
Bypass PHP disable_functions restrictions on Windows systems running PHP <= 5.2.9. Use this skill when performing authorized security assessments on legacy Windows PHP applications where functions like exec(), system(), shell_exec() are disabled. This…
Langue du texte source : anglais
Bypass PHP disable_functions, open_basedir, and safe_mode restrictions using the legacy perl PHP extension (CVE-2007-4596) or PHP-CGI argument injection (CVE-2024-4577). Use this skill whenever you need to execute commands, read arbitrary files, or escalate…
Langue du texte source : anglais
Bypass PHP disable_functions restriction using /proc/self/mem manipulation. Use this skill whenever the user needs to execute disabled PHP functions (like system(), exec(), shell_exec()) in a restricted environment, mentions PHP function restrictions, or is…
Langue du texte source : anglais
Use this skill when analyzing PHP applications for security vulnerabilities, specifically when investigating ionCube extension misconfigurations that may allow bypassing disable_functions and safe_mode restrictions. Trigger this skill when users mention PHP…
Langue du texte source : anglais
Use this skill when pentesting PHP applications to bypass disabled_functions restrictions using the Shellshock vulnerability (CVE-2014-6271). Trigger when the user mentions PHP security testing, disabled_functions bypass, Shellshock exploitation, mail()…
Langue du texte source : anglais
Use this skill whenever you need to bypass PHP security restrictions, execute commands through PHP, or work with disable_functions/open_basedir limitations during web application security testing. Trigger this skill for any PHP-related pentesting tasks…
Langue du texte source : anglais
How to exploit PrestaShop vulnerabilities including XSS-to-RCE escalation and account takeover attacks. Use this skill whenever the user mentions PrestaShop, e-commerce security testing, PrestaXSRF, CVE-2025-61922, ps_checkout module vulnerabilities, or needs…
Langue du texte source : anglais
WebDAV server exploitation and pentesting. Use this skill whenever the user mentions WebDAV, HTTP file upload vulnerabilities, webshell deployment, PUT/MOVE request attacks, IIS WebDAV bypass, or needs to test WebDAV servers for security issues. Trigger on…
Langue du texte source : anglais
How to test for Python-based vulnerabilities including code execution, SSTI (Server-Side Template Injection), deserialization attacks, and sandbox escapes. Use this skill whenever the user mentions Python vulnerabilities, template injection, pickle…
Langue du texte source : anglais