Test design, vulnerability assessment, and quality assurance (13K skills)
Use this playbook to identify and analyze encoded text in CTF challenges. It guides frequency and coincidence analysis, key-length checks, and attack methods for substitution, Vigenere, transposition, and XOR ciphers, with practical tool references.
This playbook covers Kerberos attack paths in Active Directory, including AS-REP roasting, Kerberoasting, delegation abuse, forged tickets, and pass-the-ticket. It helps readers understand the relevant ticket types, prerequisites, and common ways these techniques fit together.
Use this skill to triage injection risks by tracing where user-controlled input is processed, such as in a browser, database, template engine, URL fetcher, XML parser, or shell. It points to a focused topic for deeper security testing.
Use this playbook to identify and assess expression language injection in Java frameworks such as Spring, Struts2, and Confluence. It distinguishes SpEL, OGNL, and Java EL, provides detection probes, and describes exploitation paths and sandbox bypasses for authorized security testing.
Explains how Java character-to-byte narrowing and permissive decoders can make a WAF or IDS inspect different text from what a backend processes. It maps affected components, attack surfaces, and source-code patterns for security testing.
Explore GraphQL schemas and API requests to find undocumented fields, hidden parameters, batching behaviors, and authorization gaps. The playbook suggests discovery probes and clues in frontend or mobile code to guide security testing.
Investigate 401 and 403 responses on restricted paths by testing path variations, HTTP methods, headers, and protocol versions. The playbook also describes combining checks and using scanners to identify access control inconsistencies.
Assess Android apps during authorized security reviews. The playbook covers intercepting pinned HTTPS traffic, checking exposed components and WebViews, testing intent redirection and root detection, and examining overlays, app backups, and stored data for weaknesses.
Assess misconfigured Active Directory Certificate Services for paths to privilege escalation or lasting access. The playbook covers certificate template weaknesses, enrollment relays, CA permissions, and certificate based authentication techniques.
Assess security risks across AI and machine learning systems, from model files and training pipelines to prediction APIs and autonomous agents. The guide covers poisoned models, adversarial inputs, model extraction, privacy attacks, LLM threats, and practical security scanning tools.
Use this skill to triage security issues in file downloads, paths, uploads, previews, and archive extraction. It helps identify where a file workflow is affected and routes the investigation to path traversal or upload validation topics.
Use this low-level security playbook to evaluate how an arbitrary memory write could lead to code execution. It compares overwrite targets across glibc versions and binary protections, and explains prerequisites such as address leaks and pointer mangling.
Analyze protected Linux and Windows binaries that change behavior when a debugger is present. Identify checks such as ptrace, process flags, timing tests, and exception handling, then consult practical bypass approaches and tool references to continue reverse engineering.
Map the reachable surface of REST, mobile, and GraphQL APIs before testing. Find endpoints, schemas, versions, and documentation, including older or less visible paths, then use those findings to plan what API behavior to examine.
Use this playbook to assess HTTP/2-specific weaknesses such as h2c upgrade smuggling, pseudo-header parsing differences, HPACK compression behavior, multiplexed request races, and HTTP/2-to-HTTP/1.1 downgrade issues. It provides attack selection guidance and references tools for authorized testing.
This playbook explains dangling markup injection, a way HTML injection can expose content that appears later in a page even when JavaScript is blocked. It covers conditions, browser behavior, possible data exposure, and limitations for security testing.
Assess whether user supplied input can reach shell commands or other process execution points. The playbook covers common entry points, different quoting contexts, and ways to detect blind injection when the application does not show command output.
Use this playbook to review DeFi protocols for flash loan, price oracle, governance, bridge, and token-standard risks. It explains how MEV (value extracted by transaction ordering), rounding errors, and other attack patterns can affect protocol behavior.
Assess container escape risks in authorized security tests across Docker, LXC, and Kubernetes. Review privileges, capabilities, mounted Docker sockets, namespaces, cgroups, and runtime weaknesses to identify paths that could expose the host.
Use this skill to review package manifests, lockfiles, and registry settings for dependency confusion risks. It explains how public packages may override internal names and how to verify exposure safely in authorized supply-chain assessments.
Use this guide to assess spreadsheet formula injection in CSV exports, reports, or imported user data. It explains how to identify formula evaluation in common spreadsheet apps, document the results, and reduce risk when exporting data.
Use this guide to plan security testing for REST, mobile, or GraphQL APIs. It helps sort findings into documentation and endpoint discovery, authorization, token handling, or hidden-field checks, then directs the investigation to a focused topic.
Use this guide to plan security checks for login, sessions, permissions, tokens, and identity protocols. It helps classify an authentication or authorization issue and points to a focused topic guide for the next step.
Assess misconfigured Active Directory permissions and trace possible privilege escalation paths. The guide covers BloodHound enumeration and risky ACL rights, including DCSync, shadow credentials, LAPS access, group changes, and writable Group Policy Objects, with examples of how these issues connect.