菜单
SkillsMP 已收集 ankitsingh015/HuntMCP 中的 47 个 Skill。打开任一 Skill 可查看来源和详情。
已展示 40 / 47 个已收集 Skill。
Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md…
原文语言：英语
CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers,…
原文语言：英语
Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus…
原文语言：英语
SSRF technique list covering IP-bypass encodings, cloud metadata endpoints (AWS/GCP/Azure/Alibaba/DigitalOcean), protocol smuggling, and common SSRF injection points (URL fetchers, image proxies, PDF generators, webhooks). Converted from…
原文语言：英语
XSS technique list covering reflected/stored/DOM/blind/mutation XSS, injection contexts, CSP bypass classes, postMessage leakage, and storage-based XSS via uploaded file formats. Converted from master-pentest-prompt.md Phase 9. Use when a parameter reflects…
原文语言：英语
A diagnostic decision tree for common curl/HTTP errors (connection failures, TLS, 400/401/403/429/500), a URL-parameter-to-test-priority lookup table, and persistence rules for how long to keep pushing on a target before moving on. Converted from…
原文语言：英语
How to start a HuntMCP engagement -- assessment mode selection, /goal focus mode, target fingerprinting, and the ROI-based testing order. Converted from master-pentest-prompt.md Phases 0.1/0.2/0.5/0.9. Use at the very start of an engagement, before any live…
原文语言：英语
The never-skip checklist of cheap, high-yield checks -- default credentials, installer leftovers, HTTP verb tampering, TRACE/XST, MIME-sniffing XSS, integer/type-confusion bypasses, unicode normalization tricks, cache deception/poisoning, and rate-limit gaps…
原文语言：英语
Systematic, tiered 403/WAF bypass decision guide plus common curl error diagnosis. Converted from master-pentest-prompt.md Phase 0.6. Use whenever a request comes back 403/blocked, or tool_resolver.classify_block() flags a WAF signature.
原文语言：英语
CI/CD pipeline and software-supply-chain attack techniques -- exposed CI secrets, poisoned pipeline execution (direct/indirect), self-hosted runner compromise, dependency confusion, typosquatting/install-script abuse, unsigned build artifacts, lockfile drift,…
原文语言：英语
Kubernetes-specific attack techniques -- anonymous API server access, RBAC misconfiguration, pod escape via privileged/hostPath/hostNetwork/mounted Docker socket, kubelet API abuse, etcd exposure, service-account token theft, ingress/admission-controller…
原文语言：英语
Race-condition / TOCTOU testing methodology -- the single-packet attack (last-byte sync) for minimizing network jitter, classic parallel-request racing, TOCTOU on non-identical request pairs, limit-overrun testing on withdrawals/coupons/OTP attempts, and…
原文语言：英语
Active Directory, Windows, and internal-network post-exploitation pivot techniques -- Kerberoasting/AS-REP roasting/pass-the-ticket/golden-silver tickets, NTLM relay and pass-the-hash, BloodHound path-to-DA analysis, ACL abuse, a default-port probe checklist…
原文语言：英语
OWASP API Security Top 10 as a dedicated API-only checklist -- BOLA, BFLA, broken object-property-level authz/mass assignment, unrestricted resource consumption, unsafe business-flow access, security misconfiguration, improper inventory management…
原文语言：英语
Structured autonomous-research methodology for when standard phases stop yielding findings -- six research loops (technology-driven, disclosed-report mining, research-blog learning, behavior-driven fuzzing, passive asset intelligence, business-logic/privilege…
原文语言：英语
How to map every finding to industry-standard frameworks for the final report -- MITRE ATT&CK tactic/technique IDs, PTES phase alignment, OWASP WSTG test-case numbering, CVSS 3.1 vector scoring, CWE IDs, and CISA KEV catalog cross-referencing. Converted from…
原文语言：英语
Mobile app (APK/IPA) testing checklist mapped to OWASP MASVS -- static decompilation for hardcoded secrets, Frida/objection cert-pinning bypass, deep-link and WebView JS-bridge hijacking, exported-component IPC abuse, backup/keystore extraction, root/frida…
原文语言：英语
OSINT and secret-hunting tactics -- Google/GitHub/paste dorking, favicon-hash Shodan pivots, source-code disclosure paths (.git/HEAD, .env, .DS_Store, backup files), Wayback URL mining, steganography in uploaded images, metadata leaks, and WHOIS-derived…
原文语言：英语
The standing background mandate that nothing gets skipped just because no phase or skill named it -- explore every discovered surface, follow every anomalous lead up to 4 levels deep, exploit rather than just note, invent new tests when no playbook matches,…
原文语言：英语
Per-CMS and per-framework attack checklists -- WordPress/Joomla/Drupal/Magento, backend frameworks (Laravel/Django/Spring Boot/Rails/PHP), and a long tail of other CMS/dev-tool products (Confluence, GitLab, Jenkins, Jira, SharePoint, phpMyAdmin, MediaWiki,…
原文语言：英语
Account-takeover techniques targeting the full identity lifecycle -- signup/verification bypass, email-change races, OAuth unlink/relink takeover, username collision via unicode/case normalization, role persistence in stale JWTs, orphaned-account…
原文语言：英语
Microservices and internal-API attack surface -- service-discovery endpoint enumeration (Consul/etcd/Eureka/Zipkin/Nacos), service-to-service JWT weaknesses, gRPC reflection/proto leaks, API gateway path-traversal/header-routing bypasses, exposed message…
原文语言：英语
Final gap-fill checklist of miscellaneous techniques that don't fit a single vuln-class skill -- OTP exposure patterns, feature-flag/beta-access toggles, multi-step flow step-skipping, "remember me" cookie forgery, image-proxy LFI, CSV/formula injection,…
原文语言：英语
Post-exploitation technique list once shell access is achieved -- reverse/bind shell one-liners across languages, interactive TTY upgrade, privilege escalation vectors (SUID/cron/capabilities/kernel CVEs/Docker), lateral movement, and egress/data-exfiltration…
原文语言：英语
XSSI (cross-site script inclusion) and client-side framework attack techniques -- JSONP hijacking, AngularJS sandbox escapes, Vue/React unsafe-HTML sinks, client-side prototype pollution gadgets, service-worker hijacking, Sass/SCSS server-side injection, and…
原文语言：英语
Conceptual mindset primers for reasoning about each major vuln class during live testing (SQLi, auth, info disclosure, access control, API testing, cache deception, request smuggling, Host header, JWT, SSTI, GraphQL, LLM) -- the "why" behind the payload, not…
原文语言：英语
Weak-crypto testing checklist -- CBC padding oracle attacks, ECB mode detection, predictable/reused IVs, hardcoded keys, weak password hashing, CBC bit-flipping, encrypted-ID-based IDOR, and timing side-channels in token comparison. Converted from…
原文语言：英语
HackTricks-level deep-cut techniques not covered by the mainstream vuln-class skills -- ESI/SSI injection, NTLM relay/coercion, SMTP header injection, JSONP hijacking, XS-Leak timing oracles, tabnabbing, DNS rebinding, exposed management interfaces…
原文语言：英语
The full PayloadsAllTheThings category checklist (60+ vuln classes) as a final coverage sweep. Converted from master-pentest-prompt.md Phase 22. Use as a closing checklist near the end of an engagement to catch any category that wasn't explicitly covered by…
原文语言：英语
CRLF injection into redirect params/Location/Set-Cookie/request URI, response-splitting to inject a rendered body, 302-splitting and hop-by-hop header abuse, and CRLF-driven request smuggling. Converted from master-pentest-prompt.md Phase 19. Use on any…
原文语言：英语
Open-redirect parameter names, common vulnerable locations (login, OAuth callback, password reset), bypass encodings, and the real-impact chain (open redirect -> OAuth token exfiltration -> account takeover). Converted from master-pentest-prompt.md Phase 18.…
原文语言：英语
Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and…
原文语言：英语
Low-to-advanced encoding cheat sheet for evading WAFs and input filters -- HTML/JS/CSS/unicode escapes, SQL whitespace/comment tricks, XSS event-handler and mXSS vectors, PHP upload-filter bypasses, path confusion, homoglyphs, chunked-smuggling-past-WAF, and…
原文语言：英语
Authentication and session-management technique list (brute-force rate-limit bypass, JWT, OAuth/OIDC, SAML/SSO, session fixation, password reset, MFA bypass) plus 2025-26 modern identity attacks (passkey/WebAuthn, OAuth device-code phishing, AiTM relay, ghost…
原文语言：英语
Denial-of-service and resilience testing techniques -- rate-limit batching bypass, ReDoS, unbounded input, decompression bombs, HPP-based DoS, and resource-exhaustion probing. Converted from master-pentest-prompt.md Phase 15. Use to check whether rate limits…
原文语言：英语
Email-domain security checklist -- SPF/DMARC/DKIM misconfiguration detection, open-relay/contact-form spoofing, ARC laundering, and third-party mail-gateway SPF re-evaluation gaps. Converted from master-pentest-prompt.md Phase 16, explicitly flagged in the…
原文语言：英语
Modern/emerging attack surface -- AI/LLM (OWASP LLM Top 10, a practical prompt-injection probing loop, and 2026-era AI-toolchain/supply-chain attacks like agent-harness config poisoning and rogue MCP servers), prototype pollution, dependency/supply-chain…
原文语言：英语
General manual-testing mindset and reasoning "engines" (memory, response-analysis, attack-chaining, payload-mutation, application-mapping, data-flow, role-comparison, anomaly-detection) that apply across every vuln class, not just one. Converted from…
原文语言：英语
Version-control and backup exposure (.git/.svn/.hg dumps), API/debug endpoint leaks (Swagger, source maps, actuator heapdumps), cloud metadata and datastore exposure (AWS/GCP/Firebase/Mongo/Redis/Elasticsearch), secrets scanning, and user/UUID enumeration…
原文语言：英语
HTTP/2/3 protocol attacks, TLS/security-header audits, WebSocket transport issues, cache poisoning/deception, exposed container/orchestration surfaces (K8s/Docker), serverless misconfig, and log-poisoning-to-RCE. Converted from master-pentest-prompt.md Phase…
原文语言：英语