查找技能

Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.

中文简介正在准备中。当前显示原文说明。

SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.

中文简介正在准备中。当前显示原文说明。

Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.

中文简介正在准备中。当前显示原文说明。

Test Retrieval-Augmented Generation (RAG) systems for data poisoning, prompt injection via retrieved documents, and data exfiltration through manipulated context windows. Use this skill when assessing RAG-based chatbots, knowledge bases, enterprise AI assistants, or any system that augments LLM responses with external document retrieval. Covers document injection, embedding manipulation, knowledge base poisoning, and cross-document inference attacks.

中文简介正在准备中。当前显示原文说明。

Generates specific, implementable fixes for every finding in findings.json. Produces code patches (unified diff), configuration changes, dependency updates, and IaC fixes — not generic advice but actual before/after code. Uses the reproduction command from each finding as the verification step: "run this after the fix — it should now fail." Stores remediation data in findings.json so the dashboard shows a Fix button and /gh-export includes the remediation in GitHub issues. Chains from /pentester, /codebase, or any scan skill after findings are produced. Chains into /gh-export for export with remediation included.

中文简介正在准备中。当前显示原文说明。

Deploy an Evil Twin (Rogue Access Point) to clone a legitimate Wi-Fi network's SSID and MAC address. By combining this with targeted deauthentication attacks, an attacker aggressively forces nearby victims to silently connect to the malicious AP, enabling pervasive Man-in-the-Middle (MitM), captive portal phishing, and credentials interception.

中文简介正在准备中。当前显示原文说明。

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

中文简介正在准备中。当前显示原文说明。

Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.

中文简介正在准备中。当前显示原文说明。

SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.

中文简介正在准备中。当前显示原文说明。

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

中文简介正在准备中。当前显示原文说明。

Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.

中文简介正在准备中。当前显示原文说明。

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.

中文简介正在准备中。当前显示原文说明。

Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.

中文简介正在准备中。当前显示原文说明。

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.

中文简介正在准备中。当前显示原文说明。

Build a custom session search tool that indexes and queries past Claude Code CLI chat logs to retrieve historical findings, techniques, and context. Based on Critical Thinking Bug Bounty Podcast Episode 166.

中文简介正在准备中。当前显示原文说明。

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

中文简介正在准备中。当前显示原文说明。

Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.

中文简介正在准备中。当前显示原文说明。

Use when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow log deletion", runner C2.

中文简介正在准备中。当前显示原文说明。

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing.

中文简介正在准备中。当前显示原文说明。

Sensitive data patterns for security testing: API keys, credit cards, emails, SSNs, phone numbers, IPs, and more. Use for data discovery and validation.

中文简介正在准备中。当前显示原文说明。

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

中文简介正在准备中。当前显示原文说明。

Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.

中文简介正在准备中。当前显示原文说明。

Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).

中文简介正在准备中。当前显示原文说明。

Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.

中文简介正在准备中。当前显示原文说明。