Test design, vulnerability assessment, and quality assurance (13K skills)
Investigate unsafe deserialization, where restoring objects from untrusted data can trigger code execution. The skill covers Java, PHP, Python, .NET, Ruby, and related patterns, with detection clues and callback-based checks for confirming execution.
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.
Investigate CSRF, where a page causes unwanted actions through a signed-in user's session. The skill covers tokens, cookie settings, JSON APIs, and account linking, with guidance for browser-based demonstrations and assessing account or financial impact.
Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.
Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.
Assess externally exposed enterprise SSL VPN gateways by identifying products, checking known vulnerabilities, and reviewing authentication backends and SAML settings. The skill provides vendor-specific checks and a staged workflow that starts with less disruptive identification before deeper testing.
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
Investigate LDAP and XPath injection in directory searches and XML-backed authentication. The skill guides checks for login bypasses and information leaks, uses control responses to reduce false positives, and distinguishes Active Directory from other LDAP directories.
Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.
Assess Kubernetes and Docker security across exposed APIs, access permissions, service account tokens, and container boundaries. Use actual data reads or command output to establish impact and distinguish information exposure from broader compromise.
Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.
Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.
Test whether user input becomes HTML markup in pages or notification emails instead of appearing as plain text. Use distinctive test markers to document reflected or stored injection, assess visible effects, and distinguish HTML injection from JavaScript execution.
Assess file upload and import features for weaknesses in file checks and processing. The skill covers extension and content-type bypasses, unsafe image and document handling, archive extraction flaws, and evidence needed to confirm execution or browser-side impact.
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
Find open redirects, where a website sends visitors to an externally controlled address. Check URL parameters and browser scripts, confirm actual navigation, and investigate whether the redirect can expose OAuth authorization codes or enable server-side access to internal services.
Prepare screenshots and network traffic records for bug bounty submissions by masking session secrets and personal data while preserving useful verification details. The skill covers capture setup, HAR cleanup, evidence filenames, and credential handling after submission.
Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.
Investigate file inclusion and path traversal flaws that let applications access unintended files. The skill guides checks for sensitive data exposure and possible code execution, using content evidence or repeatable indirect signals to avoid false positives.
Review API configuration and input handling for unauthorized field updates, prototype pollution that alters shared object defaults, and manipulation of backend URLs. The skill also covers exposed API specifications and access control weaknesses in OData queries.
Inspect NTLM authentication responses from public IIS, SharePoint, and Exchange services to identify exposed internal domains, server names, and timestamps. Assess the disclosure in context and prepare reproducible evidence without completing authentication.
Organize a bug bounty investigation from reconnaissance through reporting. The skill helps choose a focused objective, identify the current phase, select relevant techniques and tools, and distinguish reproducible security impact from misleading test results.
Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.