HACKING SKILLS / HackSkills

Overview

This is a top-level routing skill for bug bounty, web security, API security, and authorized penetration testing.

Its core role is not to replace all specialized techniques, but to help the agent:

1. First determine the testing phase (Recon / Validation / Privilege Escalation / Chain building)
2. Then select the correct vulnerability category
3. Avoid relying only on baseline model memory; prefer structured methodology
4. Prioritize boundary conditions AI often misses but that matter in real engagements

Trust Model

• This knowledge base emphasizes content safety and auditability.
• Use this only within authorized targets, legitimate research, defensive validation, and bug-bounty-approved rules.
• Do not use these techniques for unauthorized attacks.

When to Use This Skill

Use this skill first in the following scenarios:

• You just received a new bug bounty target and do not know where to start
• You need to decide whether to load XSS / SQLi / SSRF / IDOR / JWT / API tracks first
• You want the agent to perform Web/API security testing with a more stable methodology
• You need to route scattered findings to the right attack surface
• You want AI to miss fewer critical test points in security work

Operating Model

Step 1: Start with Recon and context validation

Collect first:

• Target type: classic web, REST API, mobile backend, admin panel, payment flow, file upload, GraphQL
• Identity and permission model: anonymous, regular user, admin, multi-tenant
• Input locations: URL, query parameters, JSON, headers, cookies, filenames, imported files, templates, reflection points
• Output locations: HTML, attributes, JS, PDF, email, logs, background tasks, mobile endpoints

Step 2: Route by observed behavior

Signal	Priority direction
Input reflects into HTML / JS	XSS / SSTI
Server actively fetches URL / hostname	SSRF
Accepts XML / Office / SVG	XXE
Path, filename, or download endpoint is controllable	Path Traversal / LFI
Many object IDs appear in APIs	IDOR / BOLA / BFLA
Login, reset password, 2FA, sessions	Auth Bypass / JWT / OAuth
Multi-step transactions, coupons, pricing, inventory	Business Logic
MongoDB / JSON query syntax exposure	NoSQL Injection
CLI tools, image processing, importers	Command Injection
HTTP parsing anomalies / front-back framing mismatch	Request Smuggling
Node.js JSON handling / controllable __proto__	Prototype Pollution
PHP weak comparison / 0e hash / loose conditions	Type Juggling
Repeated parameter names / WAF-app parsing mismatch	HTTP Parameter Pollution
One-time operations (coupon/inventory/reset)	Race Condition
XML/XSLT template processing	XSLT Injection
Accessible .git/.svn/.env paths	Insecure SCM
CSV/Excel export features	CSV Formula Injection
WebSocket protocol upgrades	WebSocket Security
Internal package names / supply-chain inventory	Dependency Confusion

Step 3: Use the most likely-hit testing order

1. Recon / Methodology
2. API Security / Auth / IDOR
3. XSS / SQLi / SSRF / SSTI / XXE
4. Business Logic / Race Condition
5. Chained exploits and privilege-escalation paths

Core Skill Map

If you have the full repository, prioritize using these topic documents together:

• Recon and Methodology
• XSS Cross Site Scripting
• SQLi SQL Injection
• SSRF Server Side Request Forgery
• XXE XML External Entity
• SSTI Server Side Template Injection
• IDOR Broken Object Authorization
• CMDi Command Injection
• Path Traversal LFI
• CSRF Cross Site Request Forgery
• API Security Router
• JWT OAuth Token Attacks
• OAuth OIDC Misconfiguration
• CORS Cross Origin Misconfiguration
• SAML SSO Assertion Attacks
• Authentication Bypass
• Business Logic Vulnerabilities
• Upload Insecure Files
• NoSQL Injection
• Request Smuggling
• Prototype Pollution
• Type Juggling (PHP)
• HTTP Parameter Pollution
• Race Condition
• XSLT Injection
• Insecure Source Code Management
• CSV Formula Injection
• WebSocket Security
• Dependency Confusion
• Ghost Bits Cast Attack

Previously separate mini skills such as payload-selection and brute-selection were merged back into their main skills to avoid router overload and selection noise.

High-Value Expert Intuitions

These are points many baseline models miss, but they are frequently effective in real bug bounty work:

1. The same filtering logic is often reused across multiple pages: if one point is bypassable, similar pages usually are too.
2. Parameter names are an attack surface too: WAFs often inspect values but not names.
3. Second-order vulnerabilities are common: safe at storage time does not mean safe when later read into a dangerous context.
4. BOLA is fundamentally 'authenticated but unauthorized': replaying with account A/B switching is critical.
5. Older API versions are most likely to miss patches: fixing v2 does not mean v1 was retired.
6. Business-logic vulnerabilities often bring highest impact: scanners miss them and they persist longer.
7. Race conditions should prioritize one-time actions: coupon redemption, claims, resets, invites, trials, inventory deduction.
8. For JWT attacks, check key and algorithm context first: do not blindly spray payloads; verify alg, kid, JWKS, and key source first.

Suggested Prompts

Use this skill as a router to make the agent clarify phase and goal first:

• "First, plan the testing route for this target using bug bounty methodology.
• "This is a REST API; prioritize BOLA, BFLA, Mass Assignment, and JWT angles.
• "This parameter triggers server-side requests; list key validation points from an SSRF perspective.
• "This feature is a payment/coupon/inventory flow; prioritize business logic and race-condition analysis.
• "I only see login and password-reset flows; analyze via Auth Bypass + OAuth/JWT + CSRF.

Installation Notes

Recommended skill name:

• hack

Recommended search keywords:

• HackSkills
• HACKING SKILLS
• bug bounty
• bug bounty hunter

Guidelines

• Prioritize routing by target type and observed behavior, not random payload enumeration.
• When payloads are needed, prefer quick-start / first-pass samples in the corresponding main skill instead of adding another intermediate router.
• Prioritize reusable filters, shared components, and cross-page reproduction paths.
• Confirm authentication, authorization, and version boundaries before deeper exploitation.
• Preserve explainable, auditable, reproducible testing processes.
• When full repository context is available, return to topic documents for finer exploitation details.