Menu
Skills dans ce dépôt
SkillsMP a collecté 908 skills depuis abelrguezr/hacktricks-skills. Ouvrez un skill pour examiner sa source et ses détails.
abelrguezr/hacktricks-skillsAffichage de 40 skills collectés sur 908.
Detect and analyze Server-Side Leaks (SS-Leaks) vulnerabilities in web applications. Use this skill whenever the user mentions server-side leaks, information disclosure, error message analysis, stack trace exposure, or wants to audit web applications for…
Langue du texte source : anglais
How to pentest decentralized applications (DApps). Use this skill whenever the user mentions DApps, Web3 applications, blockchain applications, smart contracts, or wants to audit/penetrate test any decentralized application. This includes NFT platforms, DeFi…
Langue du texte source : anglais
Audit and remediate dependency confusion vulnerabilities in package management configurations. Use this skill whenever the user mentions package managers (npm, pip, Maven, Gradle, NuGet, Go modules, Cargo, Bundler), CI/CD security, supply chain attacks,…
Langue du texte source : anglais
Java deserialization vulnerability assessment and exploitation. Use this skill whenever the user mentions Java deserialization, ObjectInputStream, readObject, gadget chains, ysoserial, or any Java serialization security testing. Trigger for pentesting Java…
Langue du texte source : anglais
Use this skill for .NET deserialization vulnerability assessment and exploitation. Trigger when investigating BinaryFormatter, SoapFormatter, Json.Net, XAML, or any .NET serialization sinks. Covers ObjectDataProvider gadgets, YSoNet/ysoserial.net payloads,…
Langue du texte source : anglais
How to identify and exploit insecure deserialization vulnerabilities across PHP, Python, NodeJS, Java, .NET, and Ruby. Use this skill whenever the user mentions deserialization, serialization, object injection, gadget chains, ysoserial, pickle, unserialize,…
Langue du texte source : anglais
How to exploit ASP.NET ViewState deserialization attacks when the secret key is known. Use this skill whenever you need to test ASP.NET applications for ViewState vulnerabilities, analyze ViewState tokens, perform deserialization attacks on .NET applications,…
Langue du texte source : anglais
Exploit ASP.NET ViewState deserialization vulnerabilities. Use this skill whenever you need to assess, enumerate, or exploit __VIEWSTATE parameters in ASP.NET applications. This includes discovering MachineKeys, generating payloads with YSoSerial.Net, and…
Langue du texte source : anglais
Detect and exploit Java deserialization vulnerabilities using DNS-based payloads, GadgetProbe, and Java Deserialization Scanner. Use this skill whenever the user mentions Java deserialization, gadget chains, ysoserial, Burp extensions for deserialization…
Langue du texte source : anglais
How to identify and exploit Java JSF ViewState deserialization vulnerabilities in web applications. Use this skill whenever the user mentions JSF, ViewState, Java web applications, deserialization attacks, .faces files, or wants to test for RCE through…
Langue du texte source : anglais
Identify and analyze Java SignedObject-gated deserialization vulnerabilities, including pre-auth reachability via error handlers. Use this skill whenever investigating Java deserialization issues, analyzing stack traces with SignedObject.getObject() calls,…
Langue du texte source : anglais
Generate and explain Java deserialization payloads using Apache Commons Collections gadget chains. Use this skill whenever the user mentions Java deserialization, Apache Commons Collections, gadget chains, ysoserial, CommonsCollections1, or needs to create…
Langue du texte source : anglais
How to discover, verify, and exploit JNDI/Log4Shell vulnerabilities in Java applications. Use this skill whenever the user mentions Log4j, JNDI, LDAP injection, CVE-2021-44228, Java deserialization, or needs to test for remote code execution through logging…
Langue du texte source : anglais
Exploit Laravel Livewire v3 deserialization vulnerabilities for RCE. Use this skill whenever the user mentions Livewire, Laravel, deserialization attacks, CVE-2025-54068, Livewire snapshots, hydration abuse, or any web application using Livewire v3. Trigger…
Langue du texte source : anglais
How to discover, debug, and exploit client-side prototype pollution vulnerabilities in JavaScript applications. Use this skill whenever the user mentions prototype pollution, __proto__, constructor.prototype, Object.prototype, or wants to find XSS via…
Langue du texte source : anglais
How to test for and exploit prototype pollution vulnerabilities in Express.js applications. Use this skill whenever you're pentesting Node.js/Express applications, analyzing JSON parsing vulnerabilities, or investigating server-side prototype pollution. Make…
Langue du texte source : anglais
How to identify and exploit prototype pollution vulnerabilities in Node.js applications. Use this skill whenever the user mentions prototype pollution, __proto__, Object.prototype, JavaScript prototype attacks, Node.js deserialization vulnerabilities, or…
Langue du texte source : anglais
Generate and test Node.js prototype pollution to RCE payloads. Use this skill whenever the user mentions prototype pollution, Node.js security testing, child_process exploitation, PP2RCE, or needs to convert prototype pollution into remote code execution.…
Langue du texte source : anglais
PHP deserialization exploitation for pentesting. Use this skill whenever you need to exploit PHP deserialization vulnerabilities, including spl_autoload_register abuse, phpggc gadget chains, PHPUnit PHPT coverage attacks, TCPDF POP chains, html2pdf phar://…
Langue du texte source : anglais
Security skill for understanding, testing, and mitigating Python YAML deserialization vulnerabilities. Use this skill whenever the user mentions YAML deserialization, PyYAML security, Python RCE through YAML, deserialization attacks, or needs to audit code…
Langue du texte source : anglais
Ruby class pollution vulnerability analysis and exploitation. Use this skill whenever the user needs to understand, identify, or test Ruby class pollution vulnerabilities in applications. This includes merge-on-attributes attacks, privilege escalation through…
Langue du texte source : anglais
Use this skill whenever you're testing Ruby on Rails applications for deserialization vulnerabilities, JSON parsing issues, or authorization bypasses involving the _json parameter. Trigger this when you see JSON endpoints, Rails controllers, or need to test…
Langue du texte source : anglais
Detect and analyze domain/subdomain takeover vulnerabilities. Use this skill whenever the user mentions subdomain takeover, domain takeover, dangling DNS records, CNAME vulnerabilities, orphaned cloud resources, or wants to audit DNS records for security…
Langue du texte source : anglais
How to identify and test email injection vulnerabilities in web applications. Use this skill whenever the user mentions email injection, header injection, PHP mail exploitation, email bypass techniques, SSO email attacks, or any email-related security…
Langue du texte source : anglais
Security testing skill for identifying and exploiting Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities. Use this skill whenever you need to test for path traversal vulnerabilities, file inclusion attacks, PHP wrapper exploitation, or…
Langue du texte source : anglais
Exploit LFI to RCE using compress.zlib:// protocol with PHP_STREAM_PREFER_STDIO race condition. Use this skill whenever you need to escalate a Local File Inclusion vulnerability to Remote Code Execution, especially when the target has security checks that…
Langue du texte source : anglais
Exploit Local File Inclusion (LFI) vulnerabilities to achieve Remote Code Execution (RCE) using the Eternal Waiting technique. Use this skill when you have an LFI vulnerability, can upload files to the target, and need to escalate to code execution by…
Langue du texte source : anglais
How to exploit LFI vulnerabilities to achieve RCE by leveraging Nginx temporary file descriptors. Use this skill whenever you encounter LFI vulnerabilities, need to escalate from file inclusion to code execution, or are investigating nginx reverse proxy…
Langue du texte source : anglais
Exploit Local File Inclusion (LFI) vulnerabilities in PHP applications using filter chains to achieve Remote Code Execution (RCE). Use this skill whenever the user mentions LFI, file inclusion, PHP filters, php://filter, or wants to exploit PHP…
Langue du texte source : anglais
How to exploit Local File Inclusion (LFI) to Remote Code Execution (RCE) using PHPInfo() output. Use this skill whenever you need to escalate LFI vulnerabilities to RCE, especially when phpinfo() pages are accessible, or when you're testing for file inclusion…
Langue du texte source : anglais
Exploit Local File Inclusion (LFI) vulnerabilities to achieve Remote Code Execution (RCE) by triggering PHP segmentation faults that leave temporary upload files undeleted. Use this skill whenever you find an LFI vulnerability in a PHP application and want to…
Langue du texte source : anglais
How to test for and exploit Local File Inclusion (LFI) vulnerabilities that can lead to Remote Code Execution (RCE) through temporary file uploads. Use this skill whenever you're testing web applications for file inclusion vulnerabilities, analyzing PHP file…
Langue du texte source : anglais
How to exploit PHP PHAR deserialization vulnerabilities. Use this skill whenever you need to test for or exploit deserialization vulnerabilities in PHP applications, especially when dealing with file inclusion via phar:// protocol, file operations like…
Langue du texte source : anglais
Exploit Local File Inclusion (LFI) vulnerabilities using PHP session upload progress to achieve Remote Code Execution (RCE). Use this skill whenever the user mentions LFI, file inclusion vulnerabilities, PHP sessions, session upload progress, or needs to…
Langue du texte source : anglais
Test file upload vulnerabilities and bypass protections. Use this skill whenever the user needs to assess file upload security, test extension bypasses, create polyglot files, or exploit upload handlers. Trigger on requests about file upload testing, webshell…
Langue du texte source : anglais
How to test PDF upload endpoints for XXE (XML External Entity) injection and CORS bypass vulnerabilities. Use this skill whenever you're pentesting file upload functionality, especially PDF uploads, or when investigating XXE injection vectors through file…
Langue du texte source : anglais
Security testing skill for Formula/CSV Injection, LaTeX Injection, and GhostScript Injection vulnerabilities. Use this skill whenever you need to test for spreadsheet formula injection (CSV/Excel), LaTeX document injection, or GhostScript PDF processing…
Langue du texte source : anglais
Pentest gRPC-Web services and endpoints. Use this skill whenever the user mentions gRPC-Web, gRPC over HTTP, protobuf services, Envoy proxies, or wants to test/audit gRPC-Web APIs. Trigger for any gRPC-Web reconnaissance, payload manipulation, CORS testing,…
Langue du texte source : anglais
How to perform H2C (HTTP/2 over cleartext) and WebSocket smuggling attacks to bypass reverse proxy protections. Use this skill whenever you need to test for upgrade header smuggling vulnerabilities, bypass WAF/proxy rules, access internal endpoints behind a…
Langue du texte source : anglais
How to assess JWT (JSON Web Token) security vulnerabilities in web applications. Use this skill whenever the user mentions JWT tokens, JSON Web Tokens, token security, authentication bypass, session hijacking, or needs to test JWT implementations for…
Langue du texte source : anglais