菜单
这个仓库中的 skills
SkillsMP 已收集 uphiago/recon-skills 中的 145 个 Skill。打开任一 Skill 可查看来源和详情。
uphiago/recon-skills已展示 40 / 145 个已收集 Skill。
Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives…
原文语言：英语
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset…
原文语言：英语
Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different…
原文语言：英语
High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated
原文语言：英语
7-phase pentest pipeline from passive recon to exploitation.
原文语言：英语
Poison CDN cache or deceive when X-Cache header is detected.
原文语言：英语
Identify CMS, frameworks, and server technology stacks on live hosts.
原文语言：英语
Exploit WP CORS credential reflection for data theft.
原文语言：英语
DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis
原文语言：英语
Find leaked API keys, tokens, and credentials in public GitHub repositories.
原文语言：英语
Detect hardcoded passwords in HTML forms, JavaScript, and API responses.
原文语言：英语
Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
原文语言：英语
Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.
原文语言：英语
Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
原文语言：英语
Exploit public bucket Content-Type override for stored XSS on target origin.
原文语言：英语
Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
原文语言：英语
Mass scan for exposed env files, backups, and git configs.
原文语言：英语
Launch stealth Chromium with C++ fingerprint patches for anti-bot bypass.
原文语言：英语
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
原文语言：英语
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
原文语言：英语
Exploit unauthenticated multi-step API flows without credentials.
原文语言：英语
Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
原文语言：英语
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation…
原文语言：英语
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause…
原文语言：英语
GCP/AWS/Azure cloud exploitation -- Cloud Functions, Firestore, Cloud Run, S3, MinIO, Blob Storage, SA keys
原文语言：英语
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix…
原文语言：英语
Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC…
原文语言：英语
Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl…
原文语言：英语
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link…
原文语言：英语
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain…
原文语言：英语
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA,…
原文语言：英语
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow…
原文语言：英语
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception…
原文语言：英语
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI…
原文语言：英语
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled…
原文语言：英语
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP…
原文语言：英语
Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors →…
原文语言：英语
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte…
原文语言：英语
Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument,…
原文语言：英语
Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway…
原文语言：英语