Netw0rkNoob

Guide authorized checks of CORS, the browser rules for sharing resources across sites. Define testing boundaries, assess origin handling and credential exposure, and organize reproduction evidence or reports explaining what was tested without finding a vulnerability.

• Define the scope of a CORS configuration review
• Review allowed origins and credential exposure
• Organize evidence for a reproducible finding

Guides authorized testing of cryptographic weaknesses, including weak algorithms, key management errors, and predictable randomness. Defines testing boundaries, alternative areas to examine, and evidence needed to document verified findings or report unsuccessful checks.

• Defining the scope of cryptographic tests
• Reviewing encryption implementation checks
• Organizing evidence of cryptographic weaknesses

Guide the scope, next checks, and evidence requirements for authorized CSRF testing, which examines unwanted requests sent through a user's browser. Covers token protection, SameSite cookie controls, and JSON requests, including reporting when evidence is insufficient.

• Define the scope of a CSRF assessment
• Review next checks when CSRF protections block testing
• Organize reproduction evidence and impact findings

Match identified products and versions against CVEs, records of known security vulnerabilities. Assess relevance, evidence quality, and patch status, then produce a candidate list to guide further investigation without attempting exploitation.

• Find CVE candidates for identified products and versions
• Assess applicability when version evidence is incomplete
• Check whether deployed versions include fixes

Guides authorized testing of unsafe deserialization, where restoring saved data can trigger unintended behavior. Covers Java, PHP, Python, and .NET, helping agents define scope, assess alternative paths, and organize verified reproduction evidence.

• Defining the scope of unsafe deserialization testing
• Reviewing alternatives when a gadget chain is unavailable
• Organizing reproduction evidence and impact assessments

Guide authorized testing of security defenses, including web application firewalls, antivirus, and endpoint detection tools. The skill defines scope, alternative testing directions, evidence requirements, and completion criteria for reporting successful bypasses or unsuccessful attempts.

• Define scope for authorized security defense testing
• Choose another direction when testing stalls
• Organize evidence for a successful bypass

Guides authorized testing of file operation flaws, including path traversal, arbitrary file access, uploads, and file inclusion. Helps agents define boundaries, reconsider test directions, and document reproduction evidence and accessible file scope.

• Defining the scope of file operation testing
• Reviewing alternatives when path or upload checks block progress
• Organizing file access evidence and impact assessments

Guides authorized testing of injection flaws outside SQL, where crafted input changes how a system interprets a request. Helps agents define scope, choose alternative directions, document reproduction evidence, and decide when findings justify a report.

• Defining the scope of non-SQL injection testing
• Reconsidering test directions when progress stalls
• Organizing reproduction evidence and impact assessments

Guide authorized testing of business logic flaws, such as skipped payment steps, altered prices, concurrency issues, and permission errors. The skill helps define boundaries, choose further investigation paths, and organize reproduction evidence and business impact assessments.

• Defining the scope of business logic testing
• Choosing further checks for payment and permission flows
• Organizing reproduction steps and business impact evidence

Guide authorized mobile app security testing across stored data, certificate checks, exposed components, and compiled code analysis. The skill organizes scope, alternative investigation paths, reproduction evidence, and completion criteria for findings and unsuccessful tests.

• Define scope for mobile app security testing
• Organize checks for stored data and exposed app components
• Choose another investigation path when app protections block testing

Guides authorized network security testing of exposed services, weaker communication protocols, interception risks, and network segmentation. Helps agents set investigation boundaries and document network structure, demonstrated weaknesses, reachable systems, and reasons for inconclusive results.

• Defining the scope of network security testing
• Reviewing exposed services and protocol weaknesses
• Assessing network segmentation and reachable systems

Guide authorized testing of open redirects, where a site sends visitors to an unintended destination. This skill defines test boundaries, alternative investigation paths, and the evidence needed to report findings or conclude an investigation.

• Define the scope of an authorized redirect test
• Review evidence for OAuth redirect_uri findings
• Choose another direction when redirect checks stall

Guides authorized payload construction testing by defining scope, alternative directions when testing stalls, and evidence requirements. Helps agents organize reproduction records and decide when to report results or return to a broader testing plan.

• Defining the scope of payload construction tests
• Reviewing alternatives when delivery tests stall
• Organizing reproduction evidence

Guides authorized security testing after initial access, covering privilege escalation, persistence, movement between systems, and data access. Helps agents define boundaries, assess demonstrated access, and document evidence or obstacles before ending the investigation.

• Defining the scope of testing after initial access
• Reviewing investigation options when privilege escalation stalls
• Documenting movement paths and the highest privileges obtained

Guide authorized security reconnaissance, the collection of information about a target. Set investigation boundaries, identify alternative sources when discovery stalls, and organize domains, ports, services, and findings for prioritizing further security testing.

• Define the scope of authorized reconnaissance
• Find alternative sources when discovery stalls
• Organize domains, IP addresses, ports, and services

Build an initial target profile from a domain, URL, or IP address by collecting availability, ports, services, subdomains, and technology details. Produces factual inputs for known vulnerability lookups and decisions about subsequent security testing.

• Start a security assessment from a domain, URL, or IP address
• Inventory exposed ports and services
• Identify subdomains and web technologies

Guide authorized reverse engineering by defining scope, choosing alternative approaches when analysis stalls, and setting evidence requirements. It helps agents prepare supported findings and analysis reports for binaries, protocols, and firmware.

• Define the scope of binary analysis
• Reconsider an approach when analysis stalls
• Review evidence before reporting findings

Guide authorized SQL injection testing, where input may change database queries. Define scope, choose alternative investigation paths, and organize requests, responses, and impact evidence, including reports that document unsuccessful checks without claiming a vulnerability is absent.

• Define the scope of SQL injection testing
• Reconsider investigation paths after blocked attempts
• Organize reproduction evidence and impact findings

Guide authorized SSRF assessments, which examine whether a server can be induced to request unintended destinations. The skill sets scope, suggests alternative investigation paths, and defines evidence for confirmed findings or reports of unsuccessful tests.

• Define the scope of an authorized SSRF assessment
• Reconsider investigation paths when request restrictions block tests
• Organize evidence that a server initiated a request

Guide authorized tests for server-side template injection, where input is evaluated as template code. This skill defines investigation boundaries, alternative checks, and the evidence needed to support findings across engines such as Jinja2 and Twig.

• Define the scope of an authorized template injection test
• Review template execution evidence and engine identification
• Consider other checks when template tests stall

Guide authorized subdomain takeover assessments involving DNS records that point to unclaimed resources. The skill defines boundaries, suggests further checks, and specifies evidence for takeover feasibility, potential impact, or a report of unsuccessful investigation.

• Define the scope of an authorized subdomain takeover assessment
• Investigate DNS records pointing to deleted services
• Organize evidence of takeover feasibility and potential impact

Coordinate authorized web application security testing by routing potential weaknesses to specialist skills. Keep testing within the target scope, organize supporting evidence, and combine individual test results into a comprehensive report.

• Choosing specialist skills for potential web vulnerabilities
• Prioritizing multiple areas for security testing
• Combining test evidence into a comprehensive report

Guide authorized cross-site scripting testing, where injected scripts run in a web page. Define test boundaries, choose alternative investigation paths, and document reproduction evidence before reporting findings or ending an inconclusive investigation.

• Define the scope of an authorized XSS assessment
• Choose another investigation path when checks stall
• Organize reproduction steps and script execution evidence

Guides authorized testing of XXE, a flaw involving external references processed in XML. Helps agents set boundaries, reconsider blocked test paths, and document evidence of file access or server requests before drawing conclusions.

• Defining the scope of XXE testing
• Reviewing XML entry points in uploaded files
• Organizing evidence of entity processing and external requests