Menu
Skills neste repositório
O SkillsMP coletou 908 skills de abelrguezr/hacktricks-skills. Abra uma skill para revisar a origem e os detalhes.
abelrguezr/hacktricks-skillsMostrando 40 de 908 skills coletadas.
Analyze, detect, and understand cookie bomb attacks for security assessments. Use this skill whenever the user mentions cookie attacks, HTTP request size issues, DoS via cookies, browser cookie limits, or needs to test for cookie-based denial of service…
Idioma do texto original: inglês
Web pentesting technique to overflow browser cookie storage and force deletion of existing cookies. Use this skill when testing for cookie manipulation vulnerabilities, when you need to remove or overwrite HttpOnly cookies, or when analyzing cookie-based…
Idioma do texto original: inglês
How to identify and exploit cookie tossing vulnerabilities in web applications. Use this skill whenever the user mentions cookie attacks, session manipulation, subdomain cookie control, session fixation, CSRF token manipulation, or wants to test for…
Idioma do texto original: inglês
Use this skill whenever testing web applications for cookie vulnerabilities, analyzing session management, or investigating authentication bypasses. Trigger on any mention of cookies, sessions, authentication tokens, CSRF, SameSite, HttpOnly, Secure flags,…
Idioma do texto original: inglês
How to test for HTTP connection contamination vulnerabilities in web applications. Use this skill whenever you need to audit HTTP/2+ connection coalescing, test reverse proxy routing, investigate potential security issues with wildcard TLS certificates, or…
Idioma do texto original: inglês
Detect and test HTTP Connection Request Smuggling vulnerabilities where reverse proxies only validate Host/:authority headers on the first request of a TCP/TLS connection. Use this skill whenever the user mentions HTTP smuggling, connection-state attacks,…
Idioma do texto original: inglês
How to perform browser-powered HTTP request smuggling (client-side desync) attacks. Use this skill whenever the user mentions HTTP request smuggling, browser-based desync, client-side request smuggling, cache poisoning via browser, or wants to abuse browser…
Idioma do texto original: inglês
HTTP Request Smuggling vulnerability detection and exploitation. Use this skill whenever the user mentions HTTP desync, request smuggling, CL.TE, TE.CL, proxy desynchronization, Content-Length/Transfer-Encoding attacks, or wants to test for HTTP request…
Idioma do texto original: inglês
How to identify and exploit HTTP/2 request smuggling vulnerabilities in downgrade scenarios. Use this skill whenever the user mentions HTTP/2, request smuggling, H2.TE, H2.CL, HTTP downgrade attacks, proxy misconfigurations, or wants to test for HTTP/2 to…
Idioma do texto original: inglês
HTTP Response Smuggling and Desync attack testing. Use this skill whenever the user needs to test for HTTP response queue desynchronisation vulnerabilities, wants to steal victim responses, perform cache poisoning, or exploit response splitting. Trigger on…
Idioma do texto original: inglês
How to find and exploit IDOR (Insecure Direct Object Reference) and BOLA (Broken Object Level Authorization) vulnerabilities in web applications and APIs. Use this skill whenever the user mentions IDOR, BOLA, authorization testing, object-level access…
Idioma do texto original: inglês
How to build iframe trap attacks for XSS exploitation. Use this skill whenever the user mentions XSS, iframe attacks, credential harvesting, payment skimmers, or wants to persist XSS payloads by trapping victims in iframes. Also use when discussing modern…
Idioma do texto original: inglês
Security testing skill for auditing JSON, XML, and YAML parser vulnerabilities. Use this skill whenever you need to test for deserialization attacks, parser inconsistencies, duplicate field exploits, case-insensitivity bypasses, or data format confusion…
Idioma do texto original: inglês
Use this skill whenever you need to test for LDAP injection vulnerabilities, analyze LDAP queries, or perform LDAP security assessments. Trigger this skill for any LDAP-related security testing, authentication bypass attempts, directory service penetration…
Idioma do texto original: inglês
How to systematically test and bypass web login mechanisms. Use this skill whenever the user mentions login pages, authentication bypass, web security testing, pentesting login forms, credential testing, or any scenario involving web application…
Idioma do texto original: inglês
SQL injection payloads for testing login form vulnerabilities. Use this skill when you need to test for SQL injection vulnerabilities in authentication forms, when analyzing login bypass techniques, or when conducting authorized penetration testing on web…
Idioma do texto original: inglês
How to find and exploit mass assignment vulnerabilities (CWE-915) for privilege escalation. Use this skill whenever you need to test APIs for insecure object binding, when analyzing self-service endpoints like /api/users/{id} or /profile, when you see JSON…
Idioma do texto original: inglês
How to test for NoSQL injection vulnerabilities in MongoDB and other NoSQL databases. Use this skill whenever the user mentions NoSQL injection, MongoDB injection, database injection testing, authentication bypass, or wants to test for NoSQL vulnerabilities…
Idioma do texto original: inglês
Security testing for OAuth 2.0 and OIDC implementations. Use this skill whenever the user mentions OAuth, authentication flows, account takeover, identity providers, SSO, login flows, authorization codes, access tokens, or any security testing related to…
Idioma do texto original: inglês
Detect and exploit open redirect vulnerabilities in web applications. Use this skill whenever you need to test for open redirect bugs, analyze redirect parameters, bypass URL validation filters, or chain redirects with XSS/SSRF. Trigger this skill for any web…
Idioma do texto original: inglês
Audit applications for ORM injection vulnerabilities across Django, Prisma, Beego, Entity Framework, and Ransack. Use this skill whenever you need to test for database query manipulation, filter bypass, relational traversal attacks, or data exfiltration…
Idioma do texto original: inglês
How to test for HTTP Parameter Pollution (HPP), JSON injection, and parameter parsing vulnerabilities in web applications. Use this skill whenever you're testing web apps for input validation issues, parameter manipulation, duplicate parameter handling, or…
Idioma do texto original: inglês
Test phone number input fields for injection vulnerabilities including XSS, SQLi, SSRF, and OTP bypass attacks. Use this skill whenever you need to assess web application security, test form inputs, audit phone number fields, or investigate potential…
Idioma do texto original: inglês
Web security testing cheatsheet for reflected input vulnerabilities. Use this skill whenever you're doing web penetration testing, security assessments, or bug bounty hunting and need to test for vulnerabilities where user input is reflected in responses.…
Idioma do texto original: inglês
Web vulnerability payloads and testing techniques for security assessments. Use this skill whenever the user is doing penetration testing, bug bounty hunting, security research, or needs web vulnerability payloads (SQL injection, XSS, path traversal, SSRF,…
Idioma do texto original: inglês
How to exploit postMessage vulnerabilities using race conditions to steal sensitive data from parent pages. Use this skill whenever the user mentions postMessage, iframe exploitation, cross-origin communication vulnerabilities, race conditions in web…
Idioma do texto original: inglês
How to exploit Same-Origin Policy (SOP) bypasses using iframes and null origins. Use this skill whenever the user mentions SOP bypass, iframe exploitation, null origin attacks, cross-origin message vulnerabilities, or needs to exploit XSS through iframe…
Idioma do texto original: inglês
How to bypass Same-Origin Policy (SOP) using postMessage vulnerabilities, DOM clobbering, and null-origin iframe techniques. Use this skill whenever the user mentions postMessage, cross-origin communication, iframe attacks, SOP bypass, DOM clobbering,…
Idioma do texto original: inglês
How to identify and exploit postMessage vulnerabilities in web applications. Use this skill whenever the user mentions postMessage, cross-origin communication, iframe messaging, event listeners, origin validation, or wants to test for message-based XSS,…
Idioma do texto original: inglês
Security testing skill for detecting and exploiting postMessage vulnerabilities through iframe location manipulation. Use this skill when testing web applications for postMessage security issues, when you need to check if nested iframes can be hijacked, when…
Idioma do texto original: inglês
How to understand and test WAF/proxy bypass techniques for authorized security assessments. Use this skill whenever you need to analyze WAF configurations, test bypass vectors, understand parser inconsistencies, or document WAF evasion methods during…
Idioma do texto original: inglês
How to identify and exploit race condition vulnerabilities in web applications. Use this skill whenever the user mentions race conditions, TOCTOU attacks, concurrent request exploitation, HTTP/2 single-packet attacks, limit-overrun vulnerabilities, hidden…
Idioma do texto original: inglês
Use this skill whenever testing rate limits, brute force protection, OTP verification, login throttling, or any API endpoint with request limits. Trigger on mentions of rate limiting, throttling, brute force, OTP bypass, login limits, API quotas, or when you…
Idioma do texto original: inglês
Test registration flows, account takeover vectors, and authentication weaknesses. Use this skill whenever the user mentions registration testing, account takeover, password reset vulnerabilities, OTP bypass, email verification flaws, user enumeration, or any…
Idioma do texto original: inglês
Use this skill whenever you need to identify, test, or exploit Regular Expression Denial of Service (ReDoS) vulnerabilities. Trigger this skill when analyzing regex patterns for security issues, testing web applications for ReDoS, generating ReDoS payloads,…
Idioma do texto original: inglês
Security testing skill for identifying password reset vulnerabilities. Use this skill whenever the user needs to test password reset functionality for security flaws, audit authentication flows, or assess reset token security. Trigger on requests about…
Idioma do texto original: inglês
Security skill for identifying and fixing reverse tab nabbing vulnerabilities in HTML links. Use this skill whenever you need to audit HTML code for target="_blank" security issues, review link patterns, or secure web applications against window.opener…
Idioma do texto original: inglês
Test REST APIs for RSQL injection vulnerabilities. Use this skill whenever you need to assess API endpoints for RSQL filter injection, including information leakage, authorization bypass, privilege escalation, and IDOR attacks. Trigger this skill when…
Idioma do texto original: inglês
Security testing skill for SAML vulnerabilities. Use this skill whenever the user needs to test SAML implementations for security issues, analyze SAML responses, perform signature wrapping attacks, test for XXE/XSLT injection, check certificate validation, or…
Idioma do texto original: inglês
Security Assertion Markup Language (SAML) reference for security testing and analysis. Use this skill whenever you need to understand SAML authentication flows, analyze SAML requests/responses, work with XML signatures, or investigate SAML-based SSO…
Idioma do texto original: inglês