🎯Skills102
A comprehensive security skills knowledge base covering 14 domains including web security, API security, privilege escalation, Active Directory attacks, reverse engineering, and cryptography, built for penetration testing, CTF competitions, and authorized security research.
Security skill providing comprehensive SQL injection attack playbooks covering union-based, blind, error-based, and time-based SQLi techniques with database-specific payloads for penetration testing and CTF competitions.
A deep-topic security skill covering code obfuscation and deobfuscation techniques including control flow flattening, opaque predicates, string encryption, and analysis of obfuscation tools such as OLLVM, Themida, and VMProtect with automated deobfuscation workflows.
Security knowledge skill covering XSS attack techniques including polyglot payloads, vendor-specific WAF bypasses (Cloudflare, Akamai, Incapsula, WordFence), CSP bypass, DOM clobbering, and CSS injection data exfiltration.
Category router skill from the HACK.SKILLS security arsenal that directs AI agents to specialized API security testing skills covering REST, GraphQL, and mobile backend attack surfaces.
A curated security skills knowledge base covering 14 domains — including mobile security, web/API security, privilege escalation, Active Directory attacks, binary exploitation, and AI/ML security — organized as 100 deep-topic skills for penetration testing, bug bounty, and CTF competitions.
Security knowledge skill covering SSRF attack techniques including cloud metadata exploitation across 6 platforms, DNS rebinding, headless browser attacks, and Gopher/Redis RCE chains, from the HACK.SKILLS arsenal.
Security knowledge skill providing a reconnaissance methodology framework including Java middleware fingerprint matrix and leak detection checklists for the information-gathering phase of security testing.
A security skill for API reconnaissance and documentation analysis, covering API endpoint discovery, OpenAPI/Swagger specification analysis, and techniques for finding hidden or undocumented endpoints.
Security knowledge skill covering API authentication attacks and JWT abuse including API key exploitation and token manipulation, part of the HACK.SKILLS API security domain.
Security knowledge skill covering JWT and OAuth token attack techniques including algorithm confusion, key confusion, claim tampering, and JWKS abuse, from the HACK.SKILLS security arsenal.
Security knowledge skill covering WebSocket security testing including Cross-Site WebSocket Hijacking (CSWSH), Origin validation flaws, and tooling guidance for wsrepl and ws-harness.
A security skill for testing authentication and authorization vulnerabilities, covering login flows, password resets, 2FA bypasses, JWT attacks, and OAuth misconfigurations with guidance on distinguishing authentication from authorization flaws.
Security knowledge skill covering authentication bypass techniques including a 22-pattern password reset matrix, 20 captcha bypass methods, and insecure randomness exploitation (UUID v1, mt_rand, ObjectId).
A curated security skills knowledge base covering 14 domains — including web security, WAF bypass, API security, privilege escalation, Active Directory attacks, binary exploitation, and AI/ML security — organized as 100 deep-topic skills for penetration testing, bug bounty, and CTF competitions.
Security skill covering business logic vulnerability testing including race conditions, pricing manipulation, workflow bypass, and state machine attacks for penetration testing and authorized security research.
A security skill from the HACK.SKILLS arsenal that teaches AI agents techniques for bypassing HTTP 401/403 access controls, including path normalization tricks, HTTP verb tampering, header-based bypasses, and IP-based ACL evasion.
A security skill for reconnaissance methodology in penetration testing, providing structured approaches for asset discovery, attack surface mapping, and information gathering when starting with a new target and limited knowledge.
Category router skill from the HACK.SKILLS arsenal that triages injection vulnerabilities and directs to specialized skills for XSS, SQLi, SSRF, XXE, SSTI, CMDi, and NoSQL injection testing.
Security knowledge skill covering IDOR and broken object-level authorization testing with an 8-category systematic approach and ORM filter chain leak detection for Django, Prisma, and Ransack.
Security knowledge skill covering OAuth flow hijacking and OIDC misconfiguration vulnerabilities, part of the HACK.SKILLS authentication security domain with 100 deep topic skills.
Security skill covering API authorization testing techniques including BOLA (Broken Object Level Authorization), BFLA, mass assignment, and object-level access control vulnerabilities for penetration testing and bug bounty.
A security skill for identifying business logic vulnerabilities, covering race conditions in transactions, pricing manipulation, workflow bypass, and state machine exploitation for business process testing during penetration tests.
A security skill from the HACK.SKILLS arsenal covering heap exploitation techniques, including use-after-free, double free, tcache poisoning, fastbin attacks, House of series techniques, and safe-linking bypass.
Security knowledge skill covering CORS misconfiguration exploitation including Origin reflection, null origin abuse, and subdomain trust issues, from the HACK.SKILLS security arsenal.
A security skill from the HACK.SKILLS arsenal covering Kubernetes penetration testing, including pod security policy bypass, RBAC abuse, ServiceAccount token theft, etcd access, container image backdoors, and kubelet API exploitation.
A security skill from the HACK.SKILLS arsenal covering network traffic analysis with PCAP files, including Wireshark/tshark analysis, protocol dissection, data extraction from captures, encrypted traffic identification, and stream reconstruction.
Security knowledge skill covering CSRF attack techniques including JSON CSRF (3 techniques), multipart upload CSRF, and the modern CSPT2CSRF variant, from the HACK.SKILLS security arsenal.
Security skill providing attack playbooks for path traversal and Local File Inclusion (LFI) vulnerabilities, including bypass techniques, payload patterns, and testing methodologies for web application security assessments.
A security skill from the HackSkills knowledge base covering GraphQL security testing, including introspection abuse, query batching attacks, and hidden parameter discovery techniques.
Security knowledge skill covering SSTI across 15+ template engines (Jinja2, Twig, Pug, Handlebars, EJS, Razor, EEx, Smarty and more), including blind SSTI techniques and Flask PIN calculation.
Security category skill that routes AI agents to file upload, download, LFI, and path control vulnerability testing techniques, serving as an entry point for file operation security assessments.
A security skill from the HACK.SKILLS arsenal covering format string vulnerability exploitation, including read/write primitives, GOT overwrite, arbitrary address write, and FORTIFY_SOURCE bypass techniques.
Security knowledge skill covering command injection techniques including WAF bypass methods (wildcards, xor, base64), PHP disable_functions bypass paths, and component-level RCE through ImageMagick, FFmpeg, and Elasticsearch.
A security skill from the HACK.SKILLS arsenal covering iOS penetration testing, including IPA analysis, Objective-C runtime manipulation, jailbreak detection bypass, Keychain access, URL scheme abuse, and binary protections.
A security skill from the HackSkills knowledge base covering insecure deserialization across multiple languages, including Java/PHP/Python chains, Ruby Marshal/YAML, .NET BinaryFormatter/ViewState/JSON.NET, and Node.js node-serialize/funcster exploits.
A security skill from the HackSkills knowledge base covering CRLF injection vulnerabilities, including HTTP header injection and response splitting techniques for security testing.
Security skill providing techniques for HTTP Parameter Pollution (HPP) attacks, covering parameter injection, duplicate parameter handling across web servers, and WAF bypass methods for security testing.
A security skill for detecting and exploiting HTTP request smuggling vulnerabilities, covering CL.TE, TE.CL, and TE.TE variants with 8 obfuscation techniques, HTTP/2 downgrade attacks, and client-side desync methods.
A security skill for exploiting race condition vulnerabilities, covering the TOCTOU model, HTTP/1.1 last-byte synchronization, HTTP/2 single-packet attacks, Turbo Intruder templates, and limit-overrun techniques via concurrent requests.
Security skill covering XML External Entity (XXE) injection attacks, including blind XXE, out-of-band data exfiltration, DTD-based exploits, and XXE payload collections for penetration testing.
A security skill from the HackSkills knowledge base focused on insecure source code management exposure, covering .git/.svn/.hg/.bzr recovery techniques, 403 vs 404 detection, and backup file pattern discovery.
A security skill from the HackSkills knowledge base that teaches agents about open redirect vulnerabilities, including redirect chain abuse and reverse tabnabbing techniques for penetration testing and bug bounty scenarios.
A security skill from the HACK.SKILLS arsenal covering kernel exploitation techniques, including kernel ROP, ret2usr, SMEP/SMAP/KPTI bypass, kernel race conditions, modprobe_path overwrite, and msg_msg exploitation.
A security skill from the HackSkills knowledge base covering Expression Language injection attacks, including SpEL, OGNL, and Java EL injection with remote code execution chains for authorized security testing.
A security skill for testing CSV formula injection vulnerabilities, covering DDE and rundll32 payload techniques, Google Sheets IMPORT-based data exfiltration, and injection vectors in CSV/Excel export functionality.
Security knowledge skill covering SAML assertion manipulation and SSO bypass techniques, part of the HACK.SKILLS authentication security domain with 100 deep topic skills across 14 domains.
A security skill from the HackSkills knowledge base covering dependency confusion attacks, including npm/pip/gem public registry hijacking, manifest identification, and scope/namespace defense strategies.
A security skill from the HackSkills knowledge base that covers web cache deception attacks, including path confusion techniques and cache key manipulation for identifying caching-layer vulnerabilities.
A security skill from the HACK.SKILLS arsenal covering LLM prompt injection attacks, including direct/indirect injection, RAG poisoning, tool/function abuse, markdown exfiltration, and MCP security risks with encoding bypass techniques.
A security skill for testing JNDI injection vulnerabilities, covering JNDI/LDAP/RMI exploitation chains, Log4Shell (CVE-2021-44228) attack patterns, and techniques for exploiting Java Naming and Directory Interface misconfigurations.
A security skill from the HackSkills knowledge base focused on clickjacking attacks, covering frame-based attack techniques and X-Frame-Options/CSP bypass methods for security testing.
A security skill from the HACK.SKILLS arsenal covering V8 browser engine exploitation, including JIT compilation bugs, type confusion, out-of-bounds read/write, sandbox escape chains, and WebAssembly abuse.
A security skill from the HackSkills knowledge base focused on JavaScript prototype pollution, covering Express black-box probing, EJS/Kibana gadget chains, and CVE-2019-7609 exploitation techniques.
A security skill for exploiting PHP type juggling vulnerabilities, covering loose comparison table analysis, magic hash collisions for MD5/SHA1/SHA256, HMAC 0e brute-force techniques, and CTF-specific bypass patterns.
A security skill from the HACK.SKILLS arsenal covering binary protection bypass techniques, including ASLR/NX/PIE/Canary/Full RELRO bypass, information leak exploitation, partial overwrite, and GOT dereference.
A security skill for testing XSLT injection vulnerabilities, covering three remote code execution chains for PHP, Java, and .NET environments, EXSLT file write techniques, and XSLT processor vendor detection methods.
A security skill from the HACK.SKILLS arsenal covering advanced Content Security Policy bypass techniques, including script gadgets, base-uri abuse, JSONP callback injection, trusted CDN exploitation, and strict-dynamic bypass.
A security skill from the HACK.SKILLS arsenal covering Active Directory ACL/DACL exploitation, including DCSync attacks, object ownership abuse, WriteDACL/GenericAll/GenericWrite attack paths, and BloodHound integration.
A security skill from the HACK.SKILLS arsenal covering HTTP Host header attacks, including password reset poisoning, web cache poisoning via Host header, routing-based SSRF, and absolute-URL override techniques.
A security skill from the HACK.SKILLS arsenal covering subdomain takeover attacks, including dangling DNS records detection, cloud service fingerprinting, verification bypass, and multi-provider takeover playbooks.
A security skill from the HACK.SKILLS arsenal covering certificate pinning bypass techniques for Android and iOS, including Frida/Objection scripts, dynamic instrumentation, and network security configuration manipulation.
A security skill from the HACK.SKILLS arsenal covering symbolic execution tools like angr, Z3, and Triton for automated vulnerability discovery, constraint solving, path exploration, and concolic execution.
A security skill from the HACK.SKILLS arsenal covering anti-debugging techniques used in reverse engineering, including ptrace detection, timing checks, self-modifying code, anti-VM detection, and exception-based anti-debug mechanisms.
A security skill from the HACK.SKILLS arsenal covering Active Directory Kerberos attacks, including Kerberoasting, AS-REP Roasting, Golden/Silver Ticket forgery, delegation abuse, and Diamond Ticket techniques.
A security skill from the HACK.SKILLS arsenal covering dangling markup injection for data exfiltration without JavaScript, including img/form/base tag abuse and CSP-safe data theft techniques.
A security skill from the HACK.SKILLS arsenal covering Windows antivirus evasion, including AMSI bypass, ETW patching, API unhooking, shellcode loaders, Living-off-the-Land binaries (LOLBins), and payload encryption/obfuscation.
A security skill from the HACK.SKILLS arsenal covering techniques to escalate arbitrary write primitives to remote code execution, including GOT/__free_hook/__malloc_hook overwrites, FSOP, _IO_FILE exploitation, and exit handler hijacking.
A security skill from the HACK.SKILLS arsenal covering AD Certificate Services attacks, including ESC1-ESC8 attack patterns, certificate template abuse, PKINIT exploitation, Shadow Credentials, and CA persistence techniques.
A security skill from the HACK.SKILLS arsenal covering VM and bytecode reverse engineering, including custom VM/bytecode analysis, Python/Java/.NET decompilation, VM handler reconstruction, and opcode mapping.
A security skill from the HACK.SKILLS arsenal covering HTTP/2-specific attacks, including H2.CL/H2.TE request smuggling, HPACK header compression attacks, stream multiplexing abuse, and HTTP/2-to-HTTP/1.1 downgrade exploitation.
A security skill from the HACK.SKILLS arsenal covering hash-based attacks, including length extension attacks, birthday attacks, hash collision exploitation, bcrypt/scrypt/argon2 analysis, and HMAC timing vulnerabilities.
A security skill from the HACK.SKILLS arsenal covering memory forensics with the Volatility framework, including process/module analysis, network artifact extraction, malware detection, registry hive analysis, and timeline reconstruction.
A security skill from the HACK.SKILLS arsenal covering email header injection attacks, including SMTP header injection, CC/BCC manipulation, mail relay abuse, and phishing via injected headers.
A security skill from the HACK.SKILLS arsenal covering classical cipher analysis, including frequency analysis, Vigenere/Kasiski methods, Hill cipher, substitution and transposition ciphers, Enigma-style analysis, and automated solving.
A security skill from the HACK.SKILLS arsenal covering stack-based buffer overflow and Return-Oriented Programming, including ROP chain construction, ret2libc, SROP, stack pivoting, and one-gadget exploitation techniques.
A security skill from the HACK.SKILLS arsenal covering container escape techniques, including Docker socket abuse, privileged container escape, cgroup breakout, runc vulnerabilities, and mounted sensitive path exploitation.
A security skill from the HACK.SKILLS arsenal covering DNS rebinding attacks for internal network access, including TTL manipulation, same-origin policy bypass, and browser mitigation evasion techniques.
A security skill from the HACK.SKILLS arsenal covering Linux lateral movement techniques, including SSH key harvesting, credential reuse, service exploitation, NFS/shared mount abuse, and cron-based persistence.
A security skill from the HACK.SKILLS arsenal covering DeFi attack patterns, including flash loan oracle manipulation, MEV sandwich/JIT/liquidation attacks, vault exploits, governance flash borrow, and bridge vulnerabilities.
A curated security skills knowledge base covering AI/ML and LLM security alongside 13 other domains — including web security, mobile, privilege escalation, cryptography, and blockchain — organized as 100 deep-topic skills for penetration testing, bug bounty, and CTF competitions.
A security skill from the HACK.SKILLS arsenal covering tunneling and pivoting techniques, including SSH tunneling, SOCKS proxy chains, chisel/ligolo-ng, port forwarding, and DNS/ICMP tunneling for network penetration.
A security skill from the HACK.SKILLS arsenal covering advanced prototype pollution attacks, including server-side gadget chain discovery, framework-specific PP-to-RCE paths for Express/Fastify/Next.js, AST injection, and build tool poisoning.
A security skill from the HACK.SKILLS arsenal covering Linux security mechanism bypasses, including SELinux/AppArmor bypass, seccomp filter evasion, namespace abuse, and LD_PRELOAD injection techniques.
A security skill from the HACK.SKILLS arsenal covering Linux privilege escalation, including SUID/SGID abuse, kernel exploits, sudo misconfiguration, cron jobs, Linux Capabilities, writable service files, and NFS no_root_squash.
A security skill from the HACK.SKILLS arsenal covering Windows privilege escalation, including token manipulation, service misconfiguration, DLL hijacking, UAC bypass, AlwaysInstallElevated, unquoted service paths, and PrintSpoofer/Potato techniques.
A security skill from the HACK.SKILLS arsenal covering network protocol-level attacks, including ARP spoofing, DNS poisoning, LLMNR/NBT-NS poisoning, DHCP starvation, IPv6 attacks, and protocol-level man-in-the-middle techniques.
A security skill from the HACK.SKILLS arsenal covering symmetric cipher attacks, including padding oracle (CBC), bit-flipping, ECB cut-and-paste, meet-in-the-middle, known-plaintext attacks, and IV reuse exploitation.
A security skill from the HACK.SKILLS arsenal covering steganography techniques for CTF and forensics, including LSB extraction, file format analysis, audio/image stego tools, EXIF metadata analysis, and multi-layer embedding detection.
A security skill from the HACK.SKILLS arsenal covering smart contract vulnerabilities, including reentrancy variants, integer overflow, delegatecall storage collision, signature replay, CREATE2 exploitation, and flash loan attack patterns.
A security skill from the HACK.SKILLS arsenal covering RSA cryptographic attacks, including Wiener attack, Boneh-Durfee, Hastad broadcast, common modulus, Coppersmith small roots, Franklin-Reiter, and PKCS#1 v1.5 padding oracle.
A security skill from the HACK.SKILLS arsenal covering sandbox escape techniques, including browser sandbox escape, seccomp bypass, IPC abuse, kernel exploitation for sandbox breakout, and policy file manipulation.
A security skill from the HACK.SKILLS arsenal covering lattice-based cryptography attacks, including LLL/BKZ lattice reduction, Hidden Number Problem, NTRU attacks, CVP/SVP solving, and knapsack cryptosystem attacks.
A security skill from the HACK.SKILLS arsenal covering Windows lateral movement techniques, including PsExec, WMI, WinRM, DCOM, Pass-the-Hash/Pass-the-Ticket, RDP hijacking, scheduled tasks, and service deployment.
A security skill for testing insecure file upload vulnerabilities, providing a 5-dimension validation defect taxonomy, server-specific parsing tricks for IIS/Apache/Nginx, editor path matrices, and success rate formulas for file upload attacks.
A security knowledge skill from the HackSkills arsenal covering NoSQL injection techniques, including blind extraction automation, duplicate key bypass, aggregation pipeline injection, and $where JavaScript execution for penetration testing and authorized security research.
A security skill from the HACK.SKILLS arsenal covering macOS security bypass techniques, including Gatekeeper bypass, TCC abuse, SIP/AMFI considerations, LaunchAgent/LaunchDaemon persistence, and quarantine flag evasion.
A security skill from the HACK.SKILLS arsenal covering NTLM relay and coercion attacks, including PetitPotam, PrinterBug, NTLM relay chains, WebDAV relay, and NTLM downgrade techniques for Active Directory exploitation.
A security skill from the HACK.SKILLS arsenal covering macOS process injection techniques, including dylib injection/hijacking, task_for_pid, XPC exploitation, Electron app injection, and DYLD_INSERT_LIBRARIES abuse.
A security knowledge skill from the HackSkills arsenal covering unauthorized access techniques for common services, including service exposure checklists, reverse proxy misconfiguration (Nginx off-by-slash, X-Forwarded-For trust, Caddy template injection) for penetration testing and authorized security research.
A security knowledge base of 100 deep topic skills across 14 security domains including web security, API security, privilege escalation, Active Directory attacks, binary exploitation, reverse engineering, cryptography, and blockchain security. Built for bug bounty, penetration testing, CTF competitions, and authorized security research.
A security playbook for the Java "Ghost Bits" cast attack (Black Hat Asia 2026), which exploits silent 16-bit char to 8-bit byte narrowing to bypass WAF/IDS protections for SQL injection, deserialization RCE, file upload, path traversal, and other attack vectors.