API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
中文简介正在准备中。当前显示原文说明。
查看安装方法安装前可以查看交给 AI 代理的指令内容。
AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
| Surface | Example |
|---|---|
| object read | /api/v1/orders/123 |
| nested object | /api/v1/users/1/invoices/9 |
| admin or internal function | /api/v1/admin/users |
| update path | PUT, PATCH, DELETE variants |
| hidden JSON fields | role, org, verified, tier |
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
中文简介正在准备中。当前显示原文说明。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
中文简介正在准备中。当前显示原文说明。
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
中文简介正在准备中。当前显示原文说明。
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
中文简介正在准备中。当前显示原文说明。
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
中文简介正在准备中。当前显示原文说明。
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
中文简介正在准备中。当前显示原文说明。