Menu
Skills neste repositório
O SkillsMP coletou 908 skills de abelrguezr/hacktricks-skills. Abra uma skill para revisar a origem e os detalhes.
abelrguezr/hacktricks-skillsMostrando 40 de 908 skills coletadas.
How to perform timing-based side-channel attacks using lazy image loading and event loop blocking. Use this skill whenever the user mentions timing attacks, side-channel exploits, lazy loading vulnerabilities, image loading timing, event loop blocking, or…
Idioma do texto original: inglês
How to perform JavaScript execution XS (cross-site) leak attacks for security testing. Use this skill when you need to extract data from a target through JavaScript execution patterns, especially when dealing with XSS vulnerabilities that can communicate with…
Idioma do texto original: inglês
How to perform timing-based side-channel attacks using performance.now() to extract hidden data from web applications. Use this skill whenever you need to brute-force secrets, flags, or sensitive data by measuring response time differences. Trigger this when…
Idioma do texto original: inglês
How to perform timing-based XSS side-channel attacks using performance.now() to extract hidden data character-by-character. Use this skill whenever the user mentions XSS vulnerabilities, timing attacks, side-channel extraction, timing-based data leaks, or…
Idioma do texto original: inglês
Cross-origin information extraction using XS-Search and XS-Leak techniques. Use this skill when analyzing web applications for side-channel vulnerabilities, testing for information leakage through timing attacks, event handlers, performance APIs, or other…
Idioma do texto original: inglês
Exploit browser URL length limits (Chrome's 2MB limit) to leak secrets character-by-character. Use this skill whenever you need to extract hidden data from URLs, CTF challenges involving URL-based secrets, or when you suspect a target is vulnerable to URL…
Idioma do texto original: inglês
How to perform XS-Search and XS-Leaks attacks to extract cross-origin information through browser side-channel vulnerabilities. Use this skill whenever the user mentions cross-origin attacks, XS-Leaks, XS-Search, side-channel attacks, browser security…
Idioma do texto original: inglês
XSLT Server-Side Injection (SSI) pentesting skill. Use this whenever the user needs to test for XSLT injection vulnerabilities, fingerprint XSLT processors, read files via XSLT, perform SSRF through XSLT, or execute code through XSLT transformations. Trigger…
Idioma do texto original: inglês
How to test for service worker vulnerabilities and XSS abuse vectors. Use this skill whenever the user mentions service workers, SW exploitation, push notifications, importScripts abuse, DOM clobbering with service workers, or wants to audit web applications…
Idioma do texto original: inglês
How to exploit Chrome's back/forward cache (bfcache) and disk cache interaction to achieve XSS. Use this skill whenever you're doing web pentesting, testing browser cache vulnerabilities, analyzing XSS vectors, or investigating client-side security issues…
Idioma do texto original: inglês
How to debug client-side JavaScript during XSS and web application security testing. Use this skill whenever you need to analyze JavaScript behavior, set persistent breakpoints, or debug JS code that changes with URL parameters. Essential for XSS testing,…
Idioma do texto original: inglês
How to identify and exploit DOM Clobbering vulnerabilities in web applications. Use this skill whenever the user mentions DOM clobbering, ID/name attribute injection, global variable override, document.cookie manipulation, or any XSS technique involving HTML…
Idioma do texto original: inglês
Use this skill whenever the user needs help with DOM Invader in Burp Suite for detecting DOM XSS, prototype pollution, DOM clobbering, or other client-side vulnerabilities. Trigger when users mention Burp Suite's DOM Invader, want to test for DOM-based…
Idioma do texto original: inglês
Analyze web applications for DOM-based Cross-Site Scripting (XSS) vulnerabilities. Use this skill whenever the user needs to find, understand, or exploit DOM XSS issues in JavaScript code, HTML pages, or web applications. Trigger on requests about DOM…
Idioma do texto original: inglês
How to test for iframe-based XSS, CSP bypasses, and SOP violations. Use this skill whenever the user mentions iframes, cross-site scripting, content security policy, sandbox attributes, credentialless iframes, or wants to test web application security around…
Idioma do texto original: inglês
Test for integer overflow and truncation vulnerabilities in web applications. Use this skill whenever you need to audit numeric parameters, file parsers, length headers, or business logic calculations for wrap-around bugs. Trigger this skill for any security…
Idioma do texto original: inglês
JavaScript hoisting-based XSS attack techniques. Use this skill whenever the user is testing for XSS vulnerabilities, JavaScript injection, RXSS (Reflected XSS), or any scenario where they need to exploit JavaScript hoisting to bypass errors, inject code…
Idioma do texto original: inglês
JavaScript-based XSS and security testing techniques. Use this skill whenever the user needs to test for XSS vulnerabilities, fuzz JavaScript input, bypass WAF protections, escape JavaScript sandboxes, or analyze JavaScript behavior for security research.…
Idioma do texto original: inglês
PDF injection vulnerability testing and exploitation. Use this skill whenever you need to test for PDF injection vulnerabilities, craft PDF injection payloads, analyze PDF structures for injection points, or assess PDF generation libraries for security…
Idioma do texto original: inglês
Server-side XSS exploitation in dynamic PDF generation systems. Use this skill whenever you encounter PDF generation from user-controlled input, HTML-to-PDF conversion, or need to test for XSS in PDF bots. Trigger for: wkhtmltopdf, TCPDF, PDFKit, iText, FPDF…
Idioma do texto original: inglês
How to identify and exploit Cross-Site Scripting (XSS) vulnerabilities in Shadow DOM contexts. Use this skill whenever the user mentions Shadow DOM, web component security, encapsulated DOM attacks, or needs to test for XSS in modern web applications using…
Idioma do texto original: inglês
How to leak script content using MIME type sniffing vulnerabilities. Use this skill whenever the user mentions XSS, content sniffing, X-Content-Type-Options, leaking JavaScript files, MIME type attacks, or needs to extract script content from a target.…
Idioma do texto original: inglês
How to exploit Same Origin Method Execution (SAME) vulnerabilities when you have limited JavaScript execution in a same-origin context. Use this skill whenever you're doing web pentesting and find a callback parameter, limited JS injection point, or any…
Idioma do texto original: inglês
Generate JavaScript payloads for XSS data exfiltration during authorized penetration testing. Use this skill whenever you need to extract sensitive data (cookies, page content, internal ports) from a compromised browser context through various channels…
Idioma do texto original: inglês
Exploit WebAssembly linear memory corruption to bypass XSS filters and achieve DOM XSS. Use this skill whenever the user mentions WebAssembly, WASM, Emscripten, linear memory corruption, memory overflow, heap corruption, XSS bypass, or any scenario where a…
Idioma do texto original: inglês
Cross-Site Scripting (XSS) vulnerability testing and exploitation. Use this skill whenever the user mentions XSS, cross-site scripting, web security testing, JavaScript injection, reflected XSS, stored XSS, DOM XSS, WAF bypass, or any web application security…
Idioma do texto original: inglês
How to find and exploit XSS vulnerabilities in Markdown parsers. Use this skill whenever the user mentions XSS in markdown, markdown injection, markdown XSS payloads, testing markdown fields for cross-site scripting, or any security testing involving markdown…
Idioma do texto original: inglês
How to detect and test for Cross-Site Script Inclusion (XSSI) vulnerabilities in web applications. Use this skill whenever you're doing web application security testing, penetration testing, or vulnerability assessment and need to check for XSSI issues. This…
Idioma do texto original: inglês
XML External Entity (XXE) vulnerability testing and exploitation. Use this skill whenever the user mentions XXE, XML parsing, XML injection, file upload vulnerabilities with XML formats (SVG, DOCX, XLIFF, RSS), or needs to test for XML-based attacks including…
Idioma do texto original: inglês
Reference for Windows APIs commonly used in malware, malware analysis techniques, and detection strategies. Use this skill whenever the user mentions malware analysis, reversing, Windows API calls, process injection, DLL injection, process hollowing,…
Idioma do texto original: inglês
How to use angr for binary analysis, CTF challenges, and reverse engineering. Use this skill whenever the user mentions binary analysis, CTF challenges, reverse engineering, symbolic execution, angr, finding passwords in binaries, bypassing checks, or…
Idioma do texto original: inglês
Use angr for binary analysis, reverse engineering, and symbolic execution. Use this skill whenever the user needs to analyze binaries, extract binary information (architecture, entry points, symbols, sections), perform dynamic analysis with simulation…
Idioma do texto original: inglês
How to use Blobrunner to load and execute shellcode/blobs in memory for reverse engineering and malware analysis. Use this skill whenever the user needs to execute raw shellcode, analyze PE files, run binary blobs in memory, or debug shellcode execution. Also…
Idioma do texto original: inglês
Use Cheat Engine for memory analysis, value scanning, pointer finding, and code injection during game/software reversing. Use this skill whenever the user needs to find where values are stored in memory, modify runtime values, trace what writes to addresses,…
Idioma do texto original: inglês
Use this skill for reverse engineering tasks including decompiling binaries, debugging shellcode, analyzing .NET/Java/Golang/Delphi/Rust applications, working with Wasm, GBA games, and using tools like IDA, x64dbg, dnSpy, Cutter, and scdbg. Trigger this skill…
Idioma do texto original: inglês
Use Z3 SMT solver to solve constraints from reversing tasks, crackmes, and binary analysis. Use this skill whenever you need to solve symbolic constraints, reverse engineer license checks, find valid inputs for binaries, or work with bit-vector arithmetic…
Idioma do texto original: inglês
Analyze and reverse engineer Word macros for security research. Use this skill whenever you need to examine VBA macros in Word documents, identify obfuscation techniques, detect junk code patterns, analyze macro forms for hidden data, or investigate…
Idioma do texto original: inglês
Extract hidden data from audio files using steganography techniques. Use this skill whenever the user mentions audio forensics, hidden messages in audio, spectrogram analysis, WAV file investigation, DTMF tones, modem sounds, or any audio file that might…
Idioma do texto original: inglês
Analyze documents for hidden steganographic content. Use this skill whenever the user needs to extract hidden data from PDFs, Office files (.docx/.xlsx/.pptx), or other document formats. Trigger on requests to find hidden files, extract embedded content,…
Idioma do texto original: inglês
Analyze images for hidden data using steganography techniques. Use this skill whenever the user mentions image forensics, CTF challenges with images, hidden messages in pictures, PNG/JPEG/GIF analysis, LSB extraction, metadata extraction, or any task…
Idioma do texto original: inglês