菜单
这个仓库中的 skills
SkillsMP 已收集 abelrguezr/hacktricks-skills 中的 908 个 Skill。打开任一 Skill 可查看来源和详情。
abelrguezr/hacktricks-skills已展示 40 / 908 个已收集 Skill。
Test for Go HTTP CONNECT method path normalization bypass vulnerabilities. Use this skill when analyzing Go web applications for path traversal issues, when investigating HTTP CONNECT method handling, or when security testing Go-based servers. This skill…
原文语言：英语
Pentest Grafana instances for misconfigurations and CVE-2024-9264 SQL Expressions RCE/LFI vulnerability. Use this skill whenever you need to assess Grafana security, check for exposed credentials in config files, enumerate data sources, or test for the…
原文语言：英语
Security testing for GraphQL endpoints. Use this skill whenever you need to test GraphQL APIs for vulnerabilities, enumerate schemas, detect exposed endpoints, or assess security configurations. Trigger this skill for any GraphQL security assessment,…
原文语言：英语
H2 Java SQL database pentesting and exploitation. Use this skill whenever the user mentions H2 database, Java SQL database vulnerabilities, database SQL injection to RCE, unauthenticated database access, or any scenario involving H2 database exploitation.…
原文语言：英语
IIS (Internet Information Services) pentesting and exploitation. Use this skill whenever the user mentions IIS, Microsoft web servers, ASPX, ASP.NET, .NET applications, web.config, trace.axd, Telerik, or any Microsoft Windows web server testing. This skill…
原文语言：英语
Configure and audit ImageMagick security policies to prevent RCE and DoS vulnerabilities. Use this skill whenever you need to secure ImageMagick installations, review policy.xml files, harden image processing services, or investigate ImageMagick-related…
原文语言：英语
How to exploit CVE-2023-46818 and related vulnerabilities in ISPConfig hosting control panels. Use this skill whenever the user mentions ISPConfig, hosting control panel pentesting, CVE-2023-46818, language editor exploitation, or needs to test for PHP code…
原文语言：英语
Security assessment and enumeration of JBoss application servers. Use this skill whenever the user mentions JBoss, JBoss AS, JBoss EAP, or needs to enumerate Java application servers, check for default credentials, find exposed management consoles, or assess…
原文语言：英语
Security assessment and penetration testing for Jira and Confluence instances. Use this skill whenever the user needs to enumerate Jira/Confluence privileges, test for known vulnerabilities (CVE-2023-22527, CVE-2023-22515, CVE-2024-21683), assess plugin…
原文语言：英语
Pentest Joomla CMS installations. Use this skill whenever the user mentions Joomla, wants to enumerate a Joomla site, check for Joomla vulnerabilities, perform brute-force attacks on Joomla, exploit Joomla RCE vulnerabilities, or assess Joomla security.…
原文语言：英语
How to exploit JSP getContextPath() vulnerabilities for XSS and link manipulation attacks. Use this skill whenever you're pentesting Java web applications with JSP files, when you find JSP endpoints that might be vulnerable to context path manipulation, or…
原文语言：英语
Laravel application security testing and exploitation. Use this skill whenever the user mentions Laravel, PHP web application pentesting, APP_KEY exploitation, cookie decryption, deserialization attacks, or any Laravel-specific vulnerability research. This…
原文语言：英语
How to enumerate, exploit, and post-exploit Microsoft SharePoint environments. Use this skill whenever the user mentions SharePoint, IIS, ASP.NET web applications, ViewState exploitation, or needs to assess SharePoint security. Make sure to use this skill for…
原文语言：英语
Security assessment and penetration testing for Moodle learning management systems. Use this skill whenever the user mentions Moodle, LMS security, educational platform pentesting, or needs to assess Moodle installations for vulnerabilities. Trigger for any…
原文语言：英语
Pentest Next.js applications for security vulnerabilities. Use this skill whenever the user mentions Next.js security testing, Next.js pentesting, Next.js vulnerability assessment, React Server Components, Server Actions, middleware bypass, or any…
原文语言：英语
Audit and test Nginx servers for common misconfigurations and vulnerabilities. Use this skill whenever you need to assess Nginx security, check for LFI vulnerabilities, test for HTTP request splitting, analyze proxy configurations, or identify dangerous…
原文语言：英语
Pentest NodeJS Express.js applications by testing and cracking cookie signatures. Use this skill whenever you need to test Express.js cookie secrets, sign/verify cookies, or perform cookie-based authentication bypass testing. Trigger this skill for any web…
原文语言：英语
Web application penetration testing methodology. Use this skill whenever the user needs to assess web applications for security vulnerabilities, enumerate web services, identify technologies, discover hidden endpoints, or perform security testing on…
原文语言：英语
Use this skill whenever analyzing Perl code for command injection vulnerabilities, especially in Apache mod_perl handlers, web applications with Perl backends, or when hunting for RCE through shell execution sinks like backticks, qx//, system(), or open()…
原文语言：英语
PHP pentesting skill for exploiting arbitrary object instantiation vulnerabilities (new $_GET["a"]($_GET["b"])) to achieve Remote Code Execution. Use this skill whenever you encounter PHP code with dynamic class instantiation, user-controlled class names, or…
原文语言：英语
How to identify and test for PHP Server-Side Request Forgery (SSRF) vulnerabilities. Use this skill whenever the user mentions PHP, SSRF, server-side request forgery, file_get_contents, WordPress remote functions, CRLF injection, or needs to test for…
原文语言：英语
PHP security testing and exploitation techniques. Use this skill whenever the user needs to test PHP applications for vulnerabilities, analyze PHP code for security issues, generate PHP payloads, understand PHP type juggling attacks, or perform web…
原文语言：英语
Audit PHP configurations for security vulnerabilities and hardening opportunities. Use this skill whenever you need to review PHP security settings, check for dangerous enabled functions, assess disable_functions configuration, verify extension_dir security,…
原文语言：英语
Security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities to bypass PHP disable_functions restrictions. Use this skill whenever the user mentions PHP security testing, disable_functions bypass, ImageMagick vulnerabilities,…
原文语言：英语
Bypass PHP disable_functions restrictions using mod_cgi CGI handler. Use this skill when testing PHP applications for command execution vulnerabilities, when PHP functions like system/exec are disabled but you have write access and mod_cgi is enabled, or when…
原文语言：英语
Bypass disabled_functions in PHP 4 >= 4.2.0 and PHP 5 using pcntl_exec. Use this skill when testing PHP applications for command execution vulnerabilities, analyzing disabled_functions configurations, or when you need to execute system commands through PHP…
原文语言：英语
How to test for PHP disable_functions and safe_mode bypass vulnerabilities during authorized penetration testing. Use this skill whenever you need to assess PHP security configurations, test for function restriction bypasses, or evaluate PHP hardening…
原文语言：英语
How to bypass PHP safe_mode and open_basedir restrictions using cURL on legacy PHP 5.2.4/5.2.5 (CVE-2007-4850). Use this skill whenever you need to read arbitrary files from a PHP server with restricted file access, especially in CTFs or legacy systems.…
原文语言：英语
Bypass PHP disable_functions restrictions using stream wrapper exploits. Use this skill when testing PHP applications for security vulnerabilities, specifically when you encounter disabled functions like fopen, file_get_contents, or similar file operations.…
原文语言：英语
Bypass PHP disable_functions restriction using the debug_backtrace() UAF vulnerability (PHP 7.0-7.4, *nix only). Use this skill when you need to execute system commands in PHP environments where functions like system(), exec(), shell_exec() are disabled. This…
原文语言：英语
How to bypass PHP disable_functions and open_basedir restrictions using PHP-FPM FastCGI protocol vulnerabilities. Use this skill whenever the user mentions PHP-FPM, FastCGI, disable_functions bypass, open_basedir bypass, PHP configuration injection, or needs…
原文语言：英语
Bypass PHP disable_functions restrictions on Windows systems running PHP <= 5.2.9. Use this skill when performing authorized security assessments on legacy Windows PHP applications where functions like exec(), system(), shell_exec() are disabled. This…
原文语言：英语
Bypass PHP disable_functions, open_basedir, and safe_mode restrictions using the legacy perl PHP extension (CVE-2007-4596) or PHP-CGI argument injection (CVE-2024-4577). Use this skill whenever you need to execute commands, read arbitrary files, or escalate…
原文语言：英语
Bypass PHP disable_functions restriction using /proc/self/mem manipulation. Use this skill whenever the user needs to execute disabled PHP functions (like system(), exec(), shell_exec()) in a restricted environment, mentions PHP function restrictions, or is…
原文语言：英语
Use this skill when analyzing PHP applications for security vulnerabilities, specifically when investigating ionCube extension misconfigurations that may allow bypassing disable_functions and safe_mode restrictions. Trigger this skill when users mention PHP…
原文语言：英语
Use this skill when pentesting PHP applications to bypass disabled_functions restrictions using the Shellshock vulnerability (CVE-2014-6271). Trigger when the user mentions PHP security testing, disabled_functions bypass, Shellshock exploitation, mail()…
原文语言：英语
Use this skill whenever you need to bypass PHP security restrictions, execute commands through PHP, or work with disable_functions/open_basedir limitations during web application security testing. Trigger this skill for any PHP-related pentesting tasks…
原文语言：英语
How to exploit PrestaShop vulnerabilities including XSS-to-RCE escalation and account takeover attacks. Use this skill whenever the user mentions PrestaShop, e-commerce security testing, PrestaXSRF, CVE-2025-61922, ps_checkout module vulnerabilities, or needs…
原文语言：英语
WebDAV server exploitation and pentesting. Use this skill whenever the user mentions WebDAV, HTTP file upload vulnerabilities, webshell deployment, PUT/MOVE request attacks, IIS WebDAV bypass, or needs to test WebDAV servers for security issues. Trigger on…
原文语言：英语
How to test for Python-based vulnerabilities including code execution, SSTI (Server-Side Template Injection), deserialization attacks, and sandbox escapes. Use this skill whenever the user mentions Python vulnerabilities, template injection, pickle…
原文语言：英语