菜单
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | owasp-ref |
| description | OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports. |
Test ideas: IDOR on every ID/UUID/slug; force browsing to admin routes; HTTP verb tampering (GET→PUT); JWT role claim tampering; path traversal in file params; CORS misconfig with credentials. CWE: 200, 201, 352, 639.
Test ideas: TLS downgrade; weak ciphers; plaintext secrets in responses; ECB mode; static IVs; predictable tokens (timestamp-based); hardcoded keys in JS bundles. CWE: 327, 328, 330, 331.
Test ideas: SQLi (error, union, blind, time-based); NoSQLi ($ne, $gt operators); command injection in filenames/URLs; SSTI ({{7*7}}, ${7*7}); LDAP, XPath, header injection.
CWE: 77, 78, 89, 90, 94, 643.
Test ideas: Business logic — negative quantities, price tampering, coupon reuse, race conditions on balance operations; missing rate limits on auth/password-reset; workflow skipping. CWE: 209, 256, 501, 522.
Test ideas: Default creds; directory listings; .git/.env exposure; verbose error pages; missing headers (CSP, HSTS, X-Frame-Options); unnecessary HTTP methods; Swagger/actuator endpoints.
CWE: 16, 611.
Test ideas: Fingerprint versions via httpx -tech-detect; check for known CVEs; look at JS bundle for outdated libraries (jQuery, lodash, moment).
CWE: 1104.
Test ideas: Credential stuffing (no rate limit); weak password reset tokens; JWT alg: none; session fixation; 2FA bypass via response manipulation; OAuth redirect_uri / state issues.
CWE: 287, 297, 384, 521.
Test ideas: Insecure deserialization (pickle, Java, YAML, PHP); CI/CD supply chain; missing SRI on script tags; auto-update without signature check. CWE: 502, 565.
Test ideas: Log injection (CRLF in user-controlled log data); log tampering; logs containing secrets. CWE: 117, 532.
Test ideas: URL fields in webhooks, avatar import, PDF/screenshot gen, SSO metadata; cloud metadata (169.254.169.254); DNS rebinding; file://, gopher://, dict://; internal port scan via blind SSRF + timing.
CWE: 918.
alg: none, HS256 with public key as secret, kid path traversal/injectionredirect_uri partial matches, missing state, authorization code reuse, PKCE downgradeSystematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
Curated index of external hacking resources — meta-lists, frameworks, wordlists, payload banks, recon/OSINT, network, exploitation, and CTF tooling. Load when the user asks "what's the tool for X", "where do I find payloads for Y", "is there a wordlist for Z", or when planning which external resource to pull for a task. Always reach for this before suggesting a generic Google search.