Scan every TCP port on explicitly authorized hosts, then identify listening services and versions with Naabu, Nmap, or Masscan. Use for network-level reconnaissance, especially after subdomain enumeration has produced artifacts/live_subdomains.txt. Do not use…
Audit authorized Apache, Nginx, IIS, Tomcat, Jetty, WildFly, WebLogic, WebSphere, JBoss, GlassFish, and HTTP/2 deployments for default content, exposed modules and consoles, unsafe headers, routing weaknesses, and protocol misconfiguration. Uses passive or…
Audit authorized domains for subdomain takeover risk across 50 dangling DNS and decommissioned SaaS/cloud conditions. Use after subdomain enumeration when CNAME, NS, MX, A/AAAA, SRV, ALIAS/ANAME, TXT, or CAA records may reference abandoned resources. Performs…
Master reconnaissance skill for exhaustive 50-point subdomain enumeration, passive OSINT scraping, active multi-resolver brute-forcing, wildcard handling, and takeover auditing based on Jason Haddix's TBHM v4.
Master technology profiling skill for exhaustive 40-point web stack detection, CDN/WAF identification, modern frontend SPA heuristics, backend runtime probing, and API architecture discovery (Swagger, GraphQL, Actuators).
Master Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) auditing skill for systematic evaluation of horizontal IDOR, vertical privilege escalation, multi-tenant boundaries, and authorization architecture based on TBHM Module 14.
Master API Security and Documentation auditing skill for systematic assessment of OpenAPI/Swagger exposure, GraphQL vulnerabilities, BOLA/BFLA, mass assignment, and gateway defense based on TBHM and OWASP API Top 10.
Master authentication and registration security skill for exhaustive 30-point login/registration bypass auditing, NoSQL/SQL/LDAP injection, mass assignment, email verification bypasses, and account takeovers based on TBHM v4.