Testing & Security skills

Assess WebSocket security in chat, notifications, and other live features. The skill covers connection checks, message permissions, tampering, and access to private channels, with validation steps to distinguish actual data exposure or state changes from misleading responses.

• Review WebSocket security in chat and notification features
• Check for cross-site access to another test account's data
• Test permissions for individual messages and private channels

Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.

• Review TLS certificates and encryption settings
• Assess DNS records for subdomain takeover
• Validate email spoofing evidence

Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.

• Finding DNS records that point to abandoned services
• Manually verifying automated takeover scan results
• Assessing effects on login flows and shared cookies

Investigate server-side template injection, where user input is interpreted as template code. The skill covers engine identification, testing email and PDF rendering, and checking whether an injection can lead to command execution on the server.

• Assessing email template rendering
• Testing PDF and report generators
• Reviewing authenticated CMS template editors

Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.

• Reviewing link previews and URL import features
• Assessing network access from PDF and screenshot generators
• Checking access to cloud metadata and internal APIs

Investigate SQL injection in search forms, filters, and APIs by choosing tests based on actual responses. The skill covers visible query results, response differences, and timing evidence, helping produce reproducible reports with concrete data impact.

• Inspect search and filter inputs for SQL injection
• Choose tests based on endpoint responses
• Review ORM query construction risks

Map a single-page application's backend API from its public JavaScript files, including routes loaded later. Compare unauthenticated responses with a protected endpoint to investigate missing authentication and access control using minimal evidence.

• Discovering backend API routes in public JavaScript
• Checking API authentication behind an SSO login
• Investigating routes in lazily loaded JavaScript files

Investigate exposed source maps, configuration files, Git history, and API specifications on websites. The skill guides source reconstruction and artifact inspection to identify leaked secrets, internal routes, and build details during the initial stages of security research.

• Checking source maps for exposed source code
• Inspecting public configuration files and Git history
• Mapping API routes from Swagger and OpenAPI specifications

Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.

• Assess anonymously accessible SharePoint endpoints
• Review legacy login paths and authentication controls
• Check conditions associated with ToolShell

Inventory old and undocumented API versions, then compare their authentication, request limits, input validation, and exposed fields with current versions. Uses API specifications and archived records to identify overlooked endpoints with weaker security controls.

• Finding API versions left reachable after deprecation
• Comparing old and current OpenAPI or Swagger specifications
• Checking security differences between API versions

Assess session management weaknesses, including sessions that survive logout or password changes, fixed session IDs, and refresh-token reuse. The skill uses two real sessions, response-body comparisons, and control checks to distinguish continued account access from misleading successful responses.

• Check whether old sessions survive logout
• Verify session invalidation after a password change
• Test refresh-token rotation and reuse detection

Review SAML single sign-on, where services exchange signed identity information, for signature and identity handling flaws. The skill guides testing and validation to determine whether altered assertions can change accounts, roles, or access decisions.

• Review SAML single sign-on flows
• Test signature validation and XML interpretation
• Check whether identity or role changes affect access

Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.

• Inventory exposed gRPC services and methods
• Check authentication and permissions on internal APIs
• Compare identity handling at proxies and backends

Assess Laravel applications for exposed secrets, accessible dashboards, and authentication or permission flaws. The skill guides checks of debug settings, signed URLs, cookies, and model updates, with validation criteria for understanding the impact of findings.

• Reviewing Laravel debug settings and exposed configuration files
• Checking access controls on Telescope and Horizon dashboards
• Testing signed URLs and unintended profile field updates

Inspect NTLM authentication responses from public IIS, SharePoint, and Exchange services to identify exposed internal domains, server names, and timestamps. Assess the disclosure in context and prepare reproducible evidence without completing authentication.

• Checking public services that advertise NTLM authentication
• Extracting internal domains and server names from responses
• Assessing the impact of exposed Active Directory structure

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Test APIs and forms with unexpected input to uncover error responses that expose internal details. The skill checks response bodies for stack traces, server paths, and library information, preserving specific evidence rather than treating every server error as a vulnerability.

• Checking JSON API error handling
• Testing form and query parameter boundaries
• Identifying internal details in error responses

Test whether CAPTCHA protections actually block form actions on the server. The skill checks missing or empty fields, reused tokens, tokens accepted for other actions, and inconsistent enforcement, then confirms bypasses through completed actions such as registration or login.

• Checking CAPTCHA enforcement on login forms
• Testing registration and password-reset endpoints
• Verifying token reuse and action binding

Investigate clickjacking, where a hidden page tricks users into unintended clicks. Check protective headers, then verify in a real browser whether the embedded page retains authentication and allows sensitive actions.

• Reviewing payment and account settings pages
• Testing OAuth authorization screens
• Checking pages with missing frame protection

Test whether an application accepts forged JWTs, signed tokens that carry identity and role information. The skill covers signature bypasses, algorithm confusion, and untrusted keys, then guides verification of access to another user's data or protected functions.

• Reviewing JWT signature verification
• Testing algorithm confusion and key handling
• Checking weak HMAC signing secrets

Prepare a /hunt security assessment by loading skills for the selected mode and, for red team work, detected platforms. Summarize the loaded set, select reporting formats, and check supplied credentials before authenticated testing.

• Preparing skills for a red team assessment
• Loading a web application security testing skill set
• Prioritizing platform skills across multiple hosts

Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.

• Review password reset links and token handling
• Check reauthentication for email and password changes
• Assess takeover risks involving JWT and SSO

Test APIs for NoSQL injection, where user input changes database queries unexpectedly. The skill focuses on MongoDB login bypass, unauthorized data retrieval, and response timing checks, and also covers Redis command injection through server-side requests.

• Test MongoDB login APIs for authentication bypass
• Review search filters and URL parameters for injection
• Investigate suspected injection through response timing

Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.

• Locate installed security tools and wordlists
• Plan reconnaissance within a program's scope
• Investigate related weaknesses and their combined impact