Investigate SQL injection in search forms, filters, and APIs by choosing tests based on actual responses. The skill covers visible query results, response differences, and timing evidence, helping produce reproducible reports with concrete data impact.
Map a single-page application's backend API from its public JavaScript files, including routes loaded later. Compare unauthenticated responses with a protected endpoint to investigate missing authentication and access control using minimal evidence.
Investigate exposed source maps, configuration files, Git history, and API specifications on websites. The skill guides source reconstruction and artifact inspection to identify leaked secrets, internal routes, and build details during the initial stages of security research.
Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.
Inventory old and undocumented API versions, then compare their authentication, request limits, input validation, and exposed fields with current versions. Uses API specifications and archived records to identify overlooked endpoints with weaker security controls.
Assess session management weaknesses, including sessions that survive logout or password changes, fixed session IDs, and refresh-token reuse. The skill uses two real sessions, response-body comparisons, and control checks to distinguish continued account access from misleading successful responses.
Review SAML single sign-on, where services exchange signed identity information, for signature and identity handling flaws. The skill guides testing and validation to determine whether altered assertions can change accounts, roles, or access decisions.
Assess the storage and retrieval layers of RAG systems, which search documents to support AI answers. Test persistent document poisoning, cross-tenant access, source-text leaks, and manipulated search rankings using independently verifiable evidence.
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
Test APIs and forms with unexpected input to uncover error responses that expose internal details. The skill checks response bodies for stack traces, server paths, and library information, preserving specific evidence rather than treating every server error as a vulnerability.
Assess GraphQL APIs in financial services for unauthorized transfers, rounding errors, duplicate transactions, and exposed personal data. The skill guides checks of account permissions and ledger changes to distinguish actual financial impact from misleading success responses.
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
Find open redirects, where a website sends visitors to an externally controlled address. Check URL parameters and browser scripts, confirm actual navigation, and investigate whether the redirect can expose OAuth authorization codes or enable server-side access to internal services.
Investigate CSRF, where a page causes unwanted actions through a signed-in user's session. The skill covers tokens, cookie settings, JSON APIs, and account linking, with guidance for browser-based demonstrations and assessing account or financial impact.
Test whether CAPTCHA protections actually block form actions on the server. The skill checks missing or empty fields, reused tokens, tokens accepted for other actions, and inconsistent enforcement, then confirms bypasses through completed actions such as registration or login.
Investigate clickjacking, where a hidden page tricks users into unintended clicks. Check protective headers, then verify in a real browser whether the embedded page retains authentication and allows sensitive actions.
Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.
Test how applications trust Host and forwarding headers to identify poisoned password reset links, shared cache contamination, and unintended internal requests. The skill provides validation criteria to distinguish reflected values from demonstrated security impact.
Assess Kubernetes and Docker security across exposed APIs, access permissions, service account tokens, and container boundaries. Use actual data reads or command output to establish impact and distinguish information exposure from broader compromise.
Test chatbots and AI agents for injected instructions, data leaks, and unauthorized access across accounts. It emphasizes reproducible evidence, verified external requests, and real data access rather than trusting the model's claims.
Investigate IDOR, an access control flaw that exposes other users' resources through changed IDs. The skill guides REST API and GraphQL testing, checks boundaries between organizations, and helps document reproducible data exposure or unauthorized changes.
Investigate file inclusion and path traversal flaws that let applications access unintended files. The skill guides checks for sensitive data exposure and possible code execution, using content evidence or repeatable indirect signals to avoid false positives.
Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.
Assess login and verification code protections, identify response differences that reveal registered accounts, and distinguish visible blocks from silent throttling. The skill guides evidence gathering to verify weaknesses and assess their practical impact.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)