Results for “deserialization”

Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.

• Trace an uploaded file to its backend effect
• Investigate archive extraction and preview generation
• Compare visible validation with backend file handling

Review source code for MCP, a protocol connecting AI applications to tools. Check authentication, input validation, unsafe execution, and other security risks, then report findings with file and line references and separate manual follow-ups.

• Reviewing an MCP server before release
• Checking authentication and validation on a network-exposed server
• Auditing tool code for unsafe execution paths

Strengthen existing tests with fast-check by checking properties across generated inputs. Find bugs that example tests miss and reduce failing inputs to small, reproducible cases. Property testing is available; the other listed workflows remain planned.

• Checking parser behavior across generated inputs
• Testing serialization and deserialization round trips
• Finding pure functions covered only by example tests

Review code changes and files for bugs, security risks, performance problems, design issues, and test coverage. Receive a structured report with prioritized findings, concrete improvement examples, positive feedback, and an overall review verdict.

• Reviewing a pull request
• Auditing code quality and security
• Finding refactoring opportunities

Review code or changes for exposed secrets, injection risks, weak encryption, and missing permission checks. Produce a structured report with severity, location, recommendations, and confidence, with a separate reviewer checking findings for false positives.

• Reviewing a module for security issues
• Checking changes for exposed secrets
• Preparing a vulnerability report with evidence

Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.

• Reviewing workflow inputs and execution triggers
• Assessing pipeline permissions and credential exposure
• Checking build artifact handoffs for tampering risks

Adapt a C/C++ vulnerability pipeline to another language, target, or detection method. The workflow gathers requirements, proposes file changes for approval, updates the implementation, and validates it against a test target containing known bugs.

• Adapt the pipeline for web application vulnerabilities
• Plan a port for smart contract auditing
• Change detection signals and report criteria

Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.

• Study root causes of common web vulnerabilities
• Plan checks for cross-user access control failures
• Investigate upload and authentication weaknesses

Assess Laravel applications for exposed secrets, accessible dashboards, and authentication or permission flaws. The skill guides checks of debug settings, signed URLs, cookies, and model updates, with validation criteria for understanding the impact of findings.

• Reviewing Laravel debug settings and exposed configuration files
• Checking access controls on Telescope and Horizon dashboards
• Testing signed URLs and unintended profile field updates

Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.

• Review classic ASP.NET Webforms security
• Check exposure of trace and error logs
• Inspect WCF service metadata access

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.

The English summary is being prepared. Showing the original description.

RenderDoc GPU frame-capture analysis — headless .rdc capture, batch deserialization, frame reports and full-text search scripts, plus the manual Event Browser / Pipeline State / shader-debug workflow. Use when an image is wrong (missing, black, NaN, wrong color, flickering), when pipeline state or resource contents need ground truth, or when a frame looks slow.

The English summary is being prepared. Showing the original description.

Work with the Upstash Redis JavaScript/TypeScript SDK for serverless Redis operations. Use for caching, session storage, rate limiting, leaderboards, full-text search (querying, filtering, aggregating with @upstash/redis search extension), and all Redis data structures. Supports automatic serialization/deserialization of JavaScript types. Search also available via @upstash/search-redis and @upstash/search-ioredis adapters for TCP clients.

The English summary is being prepared. Showing the original description.

Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth Toolkit

The English summary is being prepared. Showing the original description.

Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.

The English summary is being prepared. Showing the original description.

Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race

The English summary is being prepared. Showing the original description.

Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks

The English summary is being prepared. Showing the original description.

Provides patterns for unit testing JSON serialization/deserialization with Jackson and `@JsonTest`. Validates JSON mapping, custom serializers, date formats, and polymorphic types. Use when testing JSON serialization, validating custom serializers, or writing JSON unit tests in Spring Boot applications.

The English summary is being prepared. Showing the original description.

RCE hunting - template injection, YAML/XML deserialization, dependency confusion, Kubernetes surfaces, CVE-specific exploits (Apache CVE-2021-41773, Spring CVE-2022-22963). OOB-mandatory for blind cases. Wiki-first, FIND schema output.

The English summary is being prepared. Showing the original description.

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".

The English summary is being prepared. Showing the original description.

Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials, and unsafe cryptography. Use when: (1) Performing security code review, (2) Analyzing code for OWASP Top 10 vulnerabilities, (3) Identifying CWE-classified weaknesses, (4) Generating security audit reports, (5) Reviewing code before deployment, or (6) Assessing third-party code security. Findings categorized by CWE ID and severity (Critical/High/Medium/Low).

The English summary is being prepared. Showing the original description.

Proposes secure remediation strategies for detected security vulnerabilities including buffer overflows, injection risks, insecure deserialization, improper authentication, and unsafe cryptographic usage. Provides recommended security checks, safer API alternatives, design-level changes, code examples, trade-off analysis, and prioritized remediation plans. Does NOT automatically modify code unless explicitly requested.

The English summary is being prepared. Showing the original description.

Use when reviewing Java or Kotlin server changes on Spring or Quarkus - security config and method security, JPA/JPQL and JdbcTemplate queries, request binding, deserialization, XML parsers, SpEL, templates, Actuator, JNDI and reflection

The English summary is being prepared. Showing the original description.

Threat-models and hardens an application, API, data flow, dependency, or deployment against authentication and authorization flaws, injection, secrets exposure, unsafe deserialization, SSRF, abuse, privacy loss, and supply-chain risk. Use for security review, threat modeling, hardening, or sensitive changes. Not for generic code style review or an unexplained bug without a security hypothesis.

The English summary is being prepared. Showing the original description.