Quickly find test input families, checks, and validation priorities once a security testing direction is known. Covers web vulnerabilities, authentication, AI, and MCP, with pointers to specialist skills and reference material.
渗透速查与Payload — 快速Payload家族、绕过提醒、验证顺序、常见测试卡片，适用于已知测试方向后快速查找
Review the instructions the agent will receive before you install.
仅在路由已明确后使用。本 Skill 用于快速查找，不替代方法论或工作流选择。
pentest-flowclient-reverseCTF 题目优先用
ctf-web/ctf-crypto/ctf-miscSkill，以下为快速卡片：
| 场景 | 快速定位 |
|---|---|
| PHP 弱比较 → 0e 开头 MD5 值 | ctf-web → php-bypass-cheatsheet.md |
| 命令注入空格绕过 → ${IFS}/$IFS$9/< | ctf-web → command-injection-bypass.md |
| eval 无回显 → 写文件/DNS 外带 | ctf-web → eval-and-rce-techniques.md |
| RSA 小指数 → 立方根/Coppersmith | ctf-crypto → rsa-attacks-cheatsheet.md |
Python Jail → __import__/func_globals | ctf-misc → python-jail-escape.md |
| 编码链 → base64→hex→ROT13 多层 | ctf-misc → encoding-chain-reference.md |
', ", ), 布尔差异, 时间差异, 报错差异<script>, <img onerror>, javascript:, DOM sink;id, |id, `id`, $(id){{7*7}}, ${7*7}, <%= 7*7 %>, 模板引擎指纹<!ENTITY>, 参数实体, OOB 外带client-reverse 稳定重放client-reverse runtime-first 路径intranet-pentest-advancedpentest-toolsreferences/08-rapid-checklists-and-payloads.md — 速查与 Payload 整合参考references/testing-methodology.md — 测试方法论No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.
Test Android app security by operating the app and inspecting network traffic first, then analyzing APK code or observing functions during execution when needed. Verify vulnerabilities and produce a report with screenshots, traffic evidence, and code review findings.
Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.
Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.
Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.