Menu
Skills dans ce dépôt
SkillsMP a collecté 97 skills depuis Wyl-cmd/kxns-cli. Ouvrez un skill pour examiner sa source et ses détails.
Wyl-cmd/kxns-cliAffichage de 40 skills collectés sur 97.
Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \ NUL /), search-filter-context vs DN-injection,…
Langue du texte source : anglais
Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal…
Langue du texte source : anglais
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…
Langue du texte source : anglais
Hunt mass assignment via sensitive field injection and ORM framework exploitation.
Langue du texte source : anglais
Hunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
Langue du texte source : anglais
Hunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
Langue du texte source : anglais
Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer…
Langue du texte source : anglais
Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
Langue du texte source : anglais
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
Langue du texte source : anglais
Hunt client-side and server-side prototype pollution for XSS, auth bypass, and RCE.
Langue du texte source : anglais
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync…
Langue du texte source : anglais
Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com),…
Langue du texte source : anglais
Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection…
Langue du texte source : anglais
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info…
Langue du texte source : anglais
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005,…
Langue du texte source : anglais
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k),…
Langue du texte source : anglais
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once…
Langue du texte source : anglais
Complete subdomain hunting — enumeration (crt.sh, subfinder, DNS brute force, permutation, TLD expansion, CT monitoring), staging/dev discovery (WordPress install takeover, security gap analysis, internal subdomain leaks via crt.sh), and takeover exploitation…
Langue du texte source : anglais
Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade…
Langue du texte source : anglais
Hunt WordPress-specific vulnerabilities — REST API user enumeration, XMLRPC brute force + SSRF + upload, CORS credential reflect on WP REST API, open registration, cross-subdirectory plugin discovery, Yoast sitemap email disclosure, Application Passwords…
Langue du texte source : anglais
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.
Langue du texte source : anglais
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and…
Langue du texte source : anglais
Entry P1 category router + expert playbook for injection testing. Covers command injection (OS shell metacharacters, blind/OOB, filter bypass, WAF bypass, reverse shells, PHP disable_functions bypass, component-level sinks), expression language injection…
Langue du texte source : anglais
Attack cameras via RTSP, ONVIF, Axis config when 554 open.
Langue du texte source : anglais
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
Langue du texte source : anglais
Decode, forge, brute JWTs when Bearer auth header is seen.
Langue du texte source : anglais
Answer KXNS CLI usage, configuration, and troubleshooting questions. Use when user asks about KXNS CLI installation, setup, configuration, slash commands, keyboard shortcuts, MCP integration, providers, environment variables, how something works internally,…
Langue du texte source : anglais
LLM prompt injection / system prompt extraction — 40+ technique catalog against hardened GPT-4o-class deployments. Covers direct/indirect/agentic attacks, encoding bypasses, delimiter smuggling, boolean extraction, positional enumeration, RAG poisoning,…
Langue du texte source : anglais
Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates.…
Langue du texte source : anglais
Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deliverable findings. Built from authorized red-team work where the client patched a…
Langue du texte source : anglais
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep —…
Langue du texte source : anglais
Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives…
Langue du texte source : anglais
Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
Langue du texte source : anglais
7-phase pentest pipeline from passive recon to exploitation.
Langue du texte source : anglais
Chain phpinfo to RCE via exec check when info.php exposed.
Langue du texte source : anglais
Port scan /8-/24 with Masscan+RustScan and nmap banners.
Langue du texte source : anglais
Nmap scan for MySQL, Redis, FTP, SSH, internal API services.
Langue du texte source : anglais
Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, choosing the first high-value security testing path, and planning industry-sector recon campaigns.
Langue du texte source : Plusieurs langues
Sector-specific recon for small business service provider websites — plumbers, HVAC, electricians, landscapers, roofers, painters, cleaners, contractors. Typically WordPress, Wix, Squarespace, or custom PHP on shared hosting with minimal security. These sites…
Langue du texte source : anglais
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the…
Langue du texte source : anglais