Menu
Skills neste repositório
O SkillsMP coletou 855 skills de xalgord/xalgorix. Abra uma skill para revisar a origem e os detalhes.
xalgord/xalgorixMostrando 40 de 855 skills coletadas.
Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.
Idioma do texto original: inglês
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
Idioma do texto original: inglês
Exploiting ORM injection (ORM Leak) where applications pass attacker-controlled keys/operators directly into ORM query builders (Django, Prisma, Beego, Ransack, Entity Framework/OData), letting attackers smuggle relational filters and comparison operators to…
Idioma do texto original: inglês
Identifying and exploiting OS command injection vulnerabilities in web applications where user input is passed to a system shell, leading to arbitrary command execution. Covers in-band, blind, and out-of-band detection across Linux and Windows, separator and…
Idioma do texto original: inglês
Exploiting insecure cross-window messaging where senders use a wildcard targetOrigin (leaking sensitive data) or receivers register message handlers with missing/weak origin validation, enabling sensitive-message theft, DOM XSS, prototype-pollution-to-XSS,…
Idioma do texto original: inglês
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
Idioma do texto original: inglês
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
Idioma do texto original: inglês
Identifying and exploiting reverse tabnabbing, where a link opened with target="_blank" without rel="noopener" gives the newly opened (attacker-controlled) page a reference to the originating window via window.opener, allowing it to redirect the original tab…
Idioma do texto original: inglês
Identifying and exploiting SAML SSO weaknesses including XML Signature Wrapping (XSW1-8), comment injection in NameID, missing/stripped signatures, recipient and audience confusion, assertion replay, key confusion, and XXE in SAML messages to forge…
Idioma do texto original: inglês
Exploiting Server-Side Includes (SSI) and Edge-Side Includes (ESI) injection where unsanitized input is reflected into content processed by an SSI-enabled web server or an ESI-capable cache/proxy (Squid, Varnish, Fastly, Akamai, nodesi), enabling command…
Idioma do texto original: inglês
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
Idioma do texto original: inglês
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
Idioma do texto original: inglês
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
Idioma do texto original: inglês
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.
Idioma do texto original: inglês
Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.
Idioma do texto original: inglês
Exploiting XPath injection where applications build XPath/XQuery expressions from unsanitized user input to query XML documents, allowing authentication bypass and blind extraction of the entire XML document (users, passwords, schema) plus out-of-band…
Idioma do texto original: inglês
Exploiting server-side XSLT injection where an application transforms XML with attacker-influenced stylesheets, enabling processor fingerprinting, local file read, SSRF, file write, and remote code execution via processor-specific extension functions…
Idioma do texto original: inglês
Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures…
Idioma do texto original: inglês
Systematically testing authentication, recovery, and identity flows for account takeover (ATO) — including Unicode/normalization email collisions, reusable reset/magic links, pre-account-takeover, response manipulation, email-verification bypass,…
Idioma do texto original: inglês
Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.
Idioma do texto original: inglês
Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.
Idioma do texto original: inglês
Testing WordPress, Drupal, Joomla, and other CMS platforms for known vulnerabilities, plugin/theme exploits, misconfigured permissions, and CMS-specific attack vectors during authorized penetration tests.
Idioma do texto original: inglês
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
Idioma do texto original: inglês
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.
Idioma do texto original: inglês
Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.
Idioma do texto original: inglês
Offensive email security assessment covering SMTP open relay, SPF/DKIM/DMARC bypass, email header injection, and email-based attack vectors during authorized penetration tests.
Idioma do texto original: inglês
Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.
Idioma do texto original: inglês
Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.
Idioma do texto original: inglês
Identifying and exploiting Reflected File Download (RFD) where an endpoint reflects attacker-controlled input into a downloadable response with an attacker-controlled filename and extension, enabling command execution on the victim's machine when the file is…
Idioma do texto original: inglês
Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.
Idioma do texto original: inglês
Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.
Idioma do texto original: inglês
Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.
Idioma do texto original: inglês
Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.
Idioma do texto original: inglês
Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve sensitive authenticated content.
Idioma do texto original: inglês
Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.
Idioma do texto original: inglês
Performing XS-Search / XS-Leaks attacks that extract cross-origin information through side channels — using inclusion methods (frames, pop-ups, HTML elements, fetch) and leak techniques (event handlers, timing, error events, global limits like connection-pool…
Idioma do texto original: inglês
Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.
Idioma do texto original: inglês
Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
Idioma do texto original: inglês
Testing business-logic flaws in e-commerce and payment flows including price/product tampering, quantity abuse, voucher and gift-card manipulation, cart and shipping IDOR, payment-method and amount tampering, currency swaps, refund manipulation, and…
Idioma do texto original: inglês
Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
Idioma do texto original: inglês