Results for “proxy”

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

HTTP/HTTPS application-layer reconnaissance after a web service is identified: fingerprinting, content/API discovery, JS/source maps, proxy/cache topology, WAF, CMS, and known CVE/PoC candidates. Recon only — do not exploit, write files, or obtain a shell. Hand CVE candidates and attack surface to the operator, who may select /web-attack. Non-HTTP ports belong to /recon.

The English summary is being prepared. Showing the original description.

Proxy Cline CLI tasks: dispatch, monitor, relay decisions.

The English summary is being prepared. Showing the original description.

Evaluates board composition, compensation alignment, and governance practices with proxy advisory and institutional investor standards. Use when analyzing governance, evaluating board effectiveness, or assessing shareholder alignment.

The English summary is being prepared. Showing the original description.

Hunt HTTP Request Smuggling (CL.TE, TE.CL, TE.TE, H2.CL, H2.TE, downgrade smuggling). Use when target is behind a reverse proxy / load balancer / CDN and you want to test for desync attacks that bypass front-end security controls.

The English summary is being prepared. Showing the original description.

Escalate blocked scraping campaigns with provider-neutral proxy rotation — decide between datacenter, residential, and mobile pools, integrate rotation with scrapling, configure session stickiness for stateful flows, monitor cost and health, and stay inside legal and ethical boundaries. Use as the next step after `headless-web-scraping` client-side stealth (StealthyFetcher, rate limiting, robots.txt) is insufficient and traffic is legitimate.

The English summary is being prepared. Showing the original description.

Deploy a self-hosted SearXNG meta search engine via Docker Compose. Covers settings.yml configuration, engine selection, result proxying, Nginx frontend, persistence, and updates. Use when setting up a private search engine without tracking, aggregating results from multiple providers, running a shared search instance for a team or organisation, or replacing reliance on a single search provider.

The English summary is being prepared. Showing the original description.

Capture outbound HTTP and telemetry from a CLI harness at runtime. Covers capture-channel selection (transcript file vs verbose-fetch stderr vs outbound proxy vs on-disk state), hook-driven per-event capture vs long-running session capture, JSONL output format for diff-friendly artifacts, and the observability table that maps each target to the cheapest channel that captures it. Use when a static finding needs runtime confirmation, when a payload shape is needed for a client re-implementation, or when dark-vs-live disambiguation requires watching what the binary actually sends.

The English summary is being prepared. Showing the original description.

用户需要从外部可观测信号推断内部隐藏状态时; 当需要"从表象看本质"时; 当直接观测不可行, 必须通过间接指标推断时。 不适用于: 可以直接观测内部的场景、纯数据查询、不需要推断的场景。

The English summary is being prepared. Showing the original description.

用户需要从可观察的外部信号推断隐藏的内部状态时激活;当需要评估某人或某系统的整体状态但无法直接检测内部时; 当多个外部信号互相矛盾需要综合判断时。 典型触发信号: 用户说"怎么看出来这个人状态怎么样""从表面现象怎么判断内在情况""几个信号互相矛盾该怎么判断"。 不适用于: 可以直接测量/检测的场景(有体检数据、有监控面板、有可量化的指标), 或只有一个信号源且无法交叉验证的情况。

The English summary is being prepared. Showing the original description.

用户长期处于某种强烈情绪中想了解对健康的影响时激活;当出现不明原因的身体症状可能与情绪相关时; 当需要用一种情绪来调节另一种情绪时(以情胜情)。 典型触发信号: 用户说"我最近一直在生气/焦虑/悲伤""情绪不好身体也跟着出问题了""怎么缓解这种情绪"。 不适用于: 急性外伤或感染类问题,或需要专业心理咨询/精神科干预的严重心理疾病。

The English summary is being prepared. Showing the original description.

Troubleshoot and resolve common issues with the ClickHouse Node.js client (@clickhouse/client). Use this skill whenever a user reports errors, unexpected behavior, or configuration questions involving the Node.js client specifically - including socket hang-up errors, Keep-Alive problems, stream handling issues, data type mismatches, read-only user restrictions, proxy/TLS setup problems, or long-running query timeouts. Trigger even when the user hasn't precisely named the issue; vague symptoms like "my inserts keep failing" or "connection drops randomly" in a Node.js context are strong signals to use this skill. Do NOT use for browser/Web client issues.

The English summary is being prepared. Showing the original description.

Work with the @upstash/blob TypeScript/JavaScript SDK for S3-compatible object storage with direct browser uploads, presigned URLs, multipart, and signed reads. Use when storing files or blobs, uploading avatars, images, videos, attachments or user documents, letting a browser upload straight to storage without proxying bytes through a server, generating public or time-limited signed URLs, serving private files, streaming large files with pause and resume, setting cache headers on stored objects, or reaching an S3-compatible bucket from the AWS SDK.

The English summary is being prepared. Showing the original description.

Use the Crabbox wrapper for OpenClaw remote validation across Linux, macOS, Windows, and WSL2, including delegated Blacksmith Testbox proof. Report the actual provider and id.

The English summary is being prepared. Showing the original description.

Build frontend Solana applications with Phantom Connect SDK and Helius infrastructure. Covers React, React Native, and browser SDK integration, transaction signing via Helius Sender, API key proxying, token gating, NFT minting, crypto payments, real-time updates, and secure frontend architecture.

The English summary is being prepared. Showing the original description.

Build frontend Solana applications with Phantom Connect SDK and Helius infrastructure. Covers React, React Native, and browser SDK integration, transaction signing via Helius Sender, API key proxying, token gating, NFT minting, crypto payments, real-time updates, and secure frontend architecture.

The English summary is being prepared. Showing the original description.

Use when installing Anthropic's Claude Science on a geo-blocked machine (e.g. China) or running it without a Claude account. Downloads the binary from the unblocked downloads.claude.ai CDN, sets up the claude-science-api-bridge local proxy to route requests to ANY OpenAI- or Anthropic-compatible API (Volcengine, DeepSeek, Kimi, Zhipu, OpenAI, local Ollama/vLLM), and applies a no-login patch so no Claude Pro/Max subscription is required.

The English summary is being prepared. Showing the original description.

Caddy guidance — automatic HTTPS, Caddyfile patterns, reverse proxying, and simple production deployments.

The English summary is being prepared. Showing the original description.

LiteLLM proxy server setup, TypeScript client patterns via OpenAI SDK, model routing, fallbacks, load balancing, spend tracking, virtual keys, and production deployment

The English summary is being prepared. Showing the original description.

Execute an IPv6 DNS Spoofing attack using `mitm6` on an IPv4-only corporate network. Exploit default Windows behavior (preferring IPv6 DHCP/DNS) to intercept NTLMv2 hashes, force WPAD rogue proxy settings, and relay credentials to Active Directory services.

The English summary is being prepared. Showing the original description.

Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of malicious requests to bypass security controls or poison caches.

The English summary is being prepared. Showing the original description.

HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting `Content-Length` and `Transfer-Encoding: chunked` headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking, and capturing other users' requests. Detect via timing attacks, differential responses, and tools like Burp's HTTP Request Smuggler extension.

The English summary is being prepared. Showing the original description.

Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.

The English summary is being prepared. Showing the original description.

Operate Cobalt Strike for red team engagements including Beacon deployment, C2 communication, post-exploitation, lateral movement, and evasion. Use this skill when conducting authorized red team operations that require a commercial C2 framework. Covers malleable C2 profiles, staged/stageless payloads, sleep and jitter configuration, SOCKS proxying, and advanced BOF (Beacon Object Files) usage for opsec-safe operations.

The English summary is being prepared. Showing the original description.