nosql-injection
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-29 00:09
Security & auditing
7,637 results
ntlm-relay-coercion
NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay…
oauth-oidc-misconfiguration
OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding,…
path-traversal-lfi
Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem…
prototype-pollution
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring…
recon-for-sec
Entry P1 category router for reconnaissance and methodology. Use when mapping scope, drawing an attack surface from one application, discovering assets,…
reverse-shell-techniques
Reverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY…
smart-contract-vulnerabilities
Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan,…
ssrf-server-side-request-forgery
SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or…
steganography-techniques
Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots,…
symbolic-execution-tools
Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis…
unauthorized-access-common-services
Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management…
upload-insecure-files
Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE…
waf-bypass-techniques
WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft…
websocket-security
WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.
xslt-injection
XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when…
security-auditor
Security vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD…
apk-reverse
Used when doing Android APK reverse engineering in a CLI environment. Applicable to APK unpacking, Java decompilation, smali modification, repackaging, Frida dynamic Hook, and switching to so/native analysis as needed. Prefer the locally installed jadx, apktool, frida, adb, ida-reverse, radare2.
browser-extension-reverse
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential…
dotnet-reverse
.NET / C# binary reverse engineering. When the target is a .NET assembly (PE header contains CLR, .exe/.dll managed program), C# compiled artifact (including NativeAOT), red team Sharp* tools (Rubeus / SharpHound / SharpHound, etc.), .NET obfuscated program (ConfuserEx /…
edr-bypass-re
Reverse-engineer the defender's implementation → targeted red team bypass. First reverse-engineer the EDR / Defender / AV hook tables, ETW providers, and AMSI implementations, then write targeted unhook / indirect syscall / ETW patch / call stack spoof. Cross-reference MITRE ATT&CK T1562…
firmware-pentest
Firmware / IoT penetration chain. Starting from getting a bunch of .bin / .img files, complete the closed loop of reverse engineering → extraction → emulation → exploitation. The methodology follows the nine stages of OWASP FSTM; the toolchain is mainly binwalk v3, unblob, EMBA, Firmadyne, and AFL++. Applicable scenarios: router/camera/smart home firmware auditing, firmware upgrade package reverse engineering, IoT...
js-reverse
Used when doing front-end JavaScript reverse engineering with js-reverse-mcp; suitable for signature-chain localization, page observation and evidence collection, runtime sampling, local environment patching and reproduction, and evidence-based output. Prefer adapting to the js-reverse_* tools in the current environment; when a stronger browser/CDP/Hook surface is needed, interlock with jshookmcp.