pruthuraut/BB-skill

access-control

Master Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) auditing skill for systematic evaluation of horizontal IDOR, vertical privilege escalation, multi-tenant boundaries, and authorization architecture based on TBHM Module 14.

原文语言：英语

api-security

Master API Security and Documentation auditing skill for systematic assessment of OpenAPI/Swagger exposure, GraphQL vulnerabilities, BOLA/BFLA, mass assignment, and gateway defense based on TBHM and OWASP API Top 10.

原文语言：英语

authbypass

Master authentication and registration security skill for exhaustive 30-point login/registration bypass auditing, NoSQL/SQL/LDAP injection, mass assignment, email verification bypasses, and account takeovers based on TBHM v4.

原文语言：英语

business-logic

Master Business Logic and Workflow Integrity auditing skill for systematic assessment of pricing manipulation, multi-step workflow circumvention, concurrency race conditions, and state machine integrity based on TBHM Modules 10 & 11.

原文语言：英语

cloud-supplychain

Master cloud storage bucket discovery, Firebase database auditing, GitHub organization secret hunting, and npm dependency confusion assessment skill based on TBHM and modern offensive supply-chain methodologies.

原文语言：英语

contentdiscovery

Master content & URL discovery skill for exhaustive 50-point directory/file fuzzing, sensitive data leak auditing (.env, .git, backups), administrative console probing, and API endpoint extraction using TBHM v4 and tailored wordlists.

原文语言：英语

credentialattacks

Master authentication and credential security skill for exhaustive 40-point password policy auditing, brute-force & rate-limiting defenses, password reset flow analysis, and 2FA/MFA bypass testing based on TBHM v4.

原文语言：英语

jsrecon

Master JavaScript reconnaissance, de-minification, source map unpacking, deep secret mining, and endpoint discovery skill for bug bounty hunting based on TBHM and modern offensive JS pipelines.

原文语言：英语

linkparamdiscovery

Master link, parameter, and client-side endpoint discovery skill for exhaustive 40-point web crawling, JavaScript AST analysis, source map recovery, hidden parameter fuzzing, and real-time protocol auditing based on TBHM v4.

原文语言：英语

recon-hunter

Full-stack recon-to-bug master skill. Runs passive + active recon, attack surface mapping, and bug discovery in one continuous 16-phase pipeline — all phases in order, zero skips. Triggers on: "recon", "enumerate", "subdomain", "find bugs", "attack surface",…

原文语言：英语

resource-exhaustion

Master application resource exhaustion and velocity control auditing skill for assessing rate limiting, form flood prevention, sensitive action re-authentication, and denial of service mitigations.

原文语言：英语

ssrf-audit

Master Server-Side Request Forgery (SSRF) and Cloud Metadata auditing skill for systematic identification of remote URL fetchers, parser differentials, cloud IMDS exposure, and egress architecture review based on TBHM Module 15.

原文语言：英语

subdomainenum

Master reconnaissance skill for exhaustive 50-point subdomain enumeration, passive OSINT scraping, active multi-resolver brute-forcing, wildcard handling, and takeover auditing based on Jason Haddix's TBHM v4.

原文语言：英语

techfingerprint

Master technology profiling skill for exhaustive 40-point web stack detection, CDN/WAF identification, modern frontend SPA heuristics, backend runtime probing, and API architecture discovery (Swagger, GraphQL, Actuators).

原文语言：英语