Menu
Skills neste repositório
O SkillsMP coletou 908 skills de abelrguezr/hacktricks-skills. Abra uma skill para revisar a origem e os detalhes.
abelrguezr/hacktricks-skillsMostrando 40 de 908 skills coletadas.
Test for Go HTTP CONNECT method path normalization bypass vulnerabilities. Use this skill when analyzing Go web applications for path traversal issues, when investigating HTTP CONNECT method handling, or when security testing Go-based servers. This skill…
Idioma do texto original: inglês
Pentest Grafana instances for misconfigurations and CVE-2024-9264 SQL Expressions RCE/LFI vulnerability. Use this skill whenever you need to assess Grafana security, check for exposed credentials in config files, enumerate data sources, or test for the…
Idioma do texto original: inglês
Security testing for GraphQL endpoints. Use this skill whenever you need to test GraphQL APIs for vulnerabilities, enumerate schemas, detect exposed endpoints, or assess security configurations. Trigger this skill for any GraphQL security assessment,…
Idioma do texto original: inglês
H2 Java SQL database pentesting and exploitation. Use this skill whenever the user mentions H2 database, Java SQL database vulnerabilities, database SQL injection to RCE, unauthenticated database access, or any scenario involving H2 database exploitation.…
Idioma do texto original: inglês
IIS (Internet Information Services) pentesting and exploitation. Use this skill whenever the user mentions IIS, Microsoft web servers, ASPX, ASP.NET, .NET applications, web.config, trace.axd, Telerik, or any Microsoft Windows web server testing. This skill…
Idioma do texto original: inglês
Configure and audit ImageMagick security policies to prevent RCE and DoS vulnerabilities. Use this skill whenever you need to secure ImageMagick installations, review policy.xml files, harden image processing services, or investigate ImageMagick-related…
Idioma do texto original: inglês
How to exploit CVE-2023-46818 and related vulnerabilities in ISPConfig hosting control panels. Use this skill whenever the user mentions ISPConfig, hosting control panel pentesting, CVE-2023-46818, language editor exploitation, or needs to test for PHP code…
Idioma do texto original: inglês
Security assessment and enumeration of JBoss application servers. Use this skill whenever the user mentions JBoss, JBoss AS, JBoss EAP, or needs to enumerate Java application servers, check for default credentials, find exposed management consoles, or assess…
Idioma do texto original: inglês
Security assessment and penetration testing for Jira and Confluence instances. Use this skill whenever the user needs to enumerate Jira/Confluence privileges, test for known vulnerabilities (CVE-2023-22527, CVE-2023-22515, CVE-2024-21683), assess plugin…
Idioma do texto original: inglês
Pentest Joomla CMS installations. Use this skill whenever the user mentions Joomla, wants to enumerate a Joomla site, check for Joomla vulnerabilities, perform brute-force attacks on Joomla, exploit Joomla RCE vulnerabilities, or assess Joomla security.…
Idioma do texto original: inglês
How to exploit JSP getContextPath() vulnerabilities for XSS and link manipulation attacks. Use this skill whenever you're pentesting Java web applications with JSP files, when you find JSP endpoints that might be vulnerable to context path manipulation, or…
Idioma do texto original: inglês
Laravel application security testing and exploitation. Use this skill whenever the user mentions Laravel, PHP web application pentesting, APP_KEY exploitation, cookie decryption, deserialization attacks, or any Laravel-specific vulnerability research. This…
Idioma do texto original: inglês
How to enumerate, exploit, and post-exploit Microsoft SharePoint environments. Use this skill whenever the user mentions SharePoint, IIS, ASP.NET web applications, ViewState exploitation, or needs to assess SharePoint security. Make sure to use this skill for…
Idioma do texto original: inglês
Security assessment and penetration testing for Moodle learning management systems. Use this skill whenever the user mentions Moodle, LMS security, educational platform pentesting, or needs to assess Moodle installations for vulnerabilities. Trigger for any…
Idioma do texto original: inglês
Pentest Next.js applications for security vulnerabilities. Use this skill whenever the user mentions Next.js security testing, Next.js pentesting, Next.js vulnerability assessment, React Server Components, Server Actions, middleware bypass, or any…
Idioma do texto original: inglês
Audit and test Nginx servers for common misconfigurations and vulnerabilities. Use this skill whenever you need to assess Nginx security, check for LFI vulnerabilities, test for HTTP request splitting, analyze proxy configurations, or identify dangerous…
Idioma do texto original: inglês
Pentest NodeJS Express.js applications by testing and cracking cookie signatures. Use this skill whenever you need to test Express.js cookie secrets, sign/verify cookies, or perform cookie-based authentication bypass testing. Trigger this skill for any web…
Idioma do texto original: inglês
Web application penetration testing methodology. Use this skill whenever the user needs to assess web applications for security vulnerabilities, enumerate web services, identify technologies, discover hidden endpoints, or perform security testing on…
Idioma do texto original: inglês
Use this skill whenever analyzing Perl code for command injection vulnerabilities, especially in Apache mod_perl handlers, web applications with Perl backends, or when hunting for RCE through shell execution sinks like backticks, qx//, system(), or open()…
Idioma do texto original: inglês
PHP pentesting skill for exploiting arbitrary object instantiation vulnerabilities (new $_GET["a"]($_GET["b"])) to achieve Remote Code Execution. Use this skill whenever you encounter PHP code with dynamic class instantiation, user-controlled class names, or…
Idioma do texto original: inglês
How to identify and test for PHP Server-Side Request Forgery (SSRF) vulnerabilities. Use this skill whenever the user mentions PHP, SSRF, server-side request forgery, file_get_contents, WordPress remote functions, CRLF injection, or needs to test for…
Idioma do texto original: inglês
PHP security testing and exploitation techniques. Use this skill whenever the user needs to test PHP applications for vulnerabilities, analyze PHP code for security issues, generate PHP payloads, understand PHP type juggling attacks, or perform web…
Idioma do texto original: inglês
Audit PHP configurations for security vulnerabilities and hardening opportunities. Use this skill whenever you need to review PHP security settings, check for dangerous enabled functions, assess disable_functions configuration, verify extension_dir security,…
Idioma do texto original: inglês
Security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities to bypass PHP disable_functions restrictions. Use this skill whenever the user mentions PHP security testing, disable_functions bypass, ImageMagick vulnerabilities,…
Idioma do texto original: inglês
Bypass PHP disable_functions restrictions using mod_cgi CGI handler. Use this skill when testing PHP applications for command execution vulnerabilities, when PHP functions like system/exec are disabled but you have write access and mod_cgi is enabled, or when…
Idioma do texto original: inglês
Bypass disabled_functions in PHP 4 >= 4.2.0 and PHP 5 using pcntl_exec. Use this skill when testing PHP applications for command execution vulnerabilities, analyzing disabled_functions configurations, or when you need to execute system commands through PHP…
Idioma do texto original: inglês
How to test for PHP disable_functions and safe_mode bypass vulnerabilities during authorized penetration testing. Use this skill whenever you need to assess PHP security configurations, test for function restriction bypasses, or evaluate PHP hardening…
Idioma do texto original: inglês
How to bypass PHP safe_mode and open_basedir restrictions using cURL on legacy PHP 5.2.4/5.2.5 (CVE-2007-4850). Use this skill whenever you need to read arbitrary files from a PHP server with restricted file access, especially in CTFs or legacy systems.…
Idioma do texto original: inglês
Bypass PHP disable_functions restrictions using stream wrapper exploits. Use this skill when testing PHP applications for security vulnerabilities, specifically when you encounter disabled functions like fopen, file_get_contents, or similar file operations.…
Idioma do texto original: inglês
Bypass PHP disable_functions restriction using the debug_backtrace() UAF vulnerability (PHP 7.0-7.4, *nix only). Use this skill when you need to execute system commands in PHP environments where functions like system(), exec(), shell_exec() are disabled. This…
Idioma do texto original: inglês
How to bypass PHP disable_functions and open_basedir restrictions using PHP-FPM FastCGI protocol vulnerabilities. Use this skill whenever the user mentions PHP-FPM, FastCGI, disable_functions bypass, open_basedir bypass, PHP configuration injection, or needs…
Idioma do texto original: inglês
Bypass PHP disable_functions restrictions on Windows systems running PHP <= 5.2.9. Use this skill when performing authorized security assessments on legacy Windows PHP applications where functions like exec(), system(), shell_exec() are disabled. This…
Idioma do texto original: inglês
Bypass PHP disable_functions, open_basedir, and safe_mode restrictions using the legacy perl PHP extension (CVE-2007-4596) or PHP-CGI argument injection (CVE-2024-4577). Use this skill whenever you need to execute commands, read arbitrary files, or escalate…
Idioma do texto original: inglês
Bypass PHP disable_functions restriction using /proc/self/mem manipulation. Use this skill whenever the user needs to execute disabled PHP functions (like system(), exec(), shell_exec()) in a restricted environment, mentions PHP function restrictions, or is…
Idioma do texto original: inglês
Use this skill when analyzing PHP applications for security vulnerabilities, specifically when investigating ionCube extension misconfigurations that may allow bypassing disable_functions and safe_mode restrictions. Trigger this skill when users mention PHP…
Idioma do texto original: inglês
Use this skill when pentesting PHP applications to bypass disabled_functions restrictions using the Shellshock vulnerability (CVE-2014-6271). Trigger when the user mentions PHP security testing, disabled_functions bypass, Shellshock exploitation, mail()…
Idioma do texto original: inglês
Use this skill whenever you need to bypass PHP security restrictions, execute commands through PHP, or work with disable_functions/open_basedir limitations during web application security testing. Trigger this skill for any PHP-related pentesting tasks…
Idioma do texto original: inglês
How to exploit PrestaShop vulnerabilities including XSS-to-RCE escalation and account takeover attacks. Use this skill whenever the user mentions PrestaShop, e-commerce security testing, PrestaXSRF, CVE-2025-61922, ps_checkout module vulnerabilities, or needs…
Idioma do texto original: inglês
WebDAV server exploitation and pentesting. Use this skill whenever the user mentions WebDAV, HTTP file upload vulnerabilities, webshell deployment, PUT/MOVE request attacks, IIS WebDAV bypass, or needs to test WebDAV servers for security issues. Trigger on…
Idioma do texto original: inglês
How to test for Python-based vulnerabilities including code execution, SSTI (Server-Side Template Injection), deserialization attacks, and sandbox escapes. Use this skill whenever the user mentions Python vulnerabilities, template injection, pickle…
Idioma do texto original: inglês