All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Detecting S3 Data Exfiltration AttemptsDetecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.Votes: 0GitHub stars: 2
- Webapp Detecting Serverless Function InjectionDetects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification.Votes: 0GitHub stars: 2
- Webapp Detecting Service Account AbuseDetect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Votes: 0GitHub stars: 2
- Webapp Detecting Shadow Api EndpointsDiscover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code repository mining for undocumented routes.Votes: 0GitHub stars: 2
- Webapp Detecting Shadow It Cloud UsageDetect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.Votes: 0GitHub stars: 2
- Webapp Detecting Sql Injection Via Waf LogsAnalyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns.Votes: 0GitHub stars: 2
- Webapp Detecting Suspicious Oauth Application ConsentDetect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.Votes: 0GitHub stars: 2
- Webapp Detecting Suspicious Powershell ExecutionDetect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.Votes: 0GitHub stars: 2
- Webapp Detecting T1055 Process Injection With SysmonDetect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.Votes: 0GitHub stars: 2
- Webapp Detecting T1548 Abuse Elevation Control MechanismDetect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.Votes: 0GitHub stars: 2
- Webapp Detecting Typosquatting Packages In Npm PypiDetects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where…Votes: 0GitHub stars: 2
- Webapp Detecting Wmi PersistenceDetect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.Votes: 0GitHub stars: 2
- Webapp Email SecurityEmail security evaluation covering phishing inspection, SPF, DKIM, and DMARC enforcement.Votes: 0GitHub stars: 2
- Webapp Eradicating Malware From Infected SystemsSystematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.Votes: 0GitHub stars: 2
- Webapp Escaping Containers To HostExploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment.Votes: 0GitHub stars: 2
- Webapp Evaluating Threat Intelligence PlatformsEvaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership.Votes: 0GitHub stars: 2
- Webapp Exploiting Ai Model File RceTesting machine-learning model files and model-loading services for remote code execution caused by insecure deserialization (pickle/PyTorch), unsafe config instantiation (Hydra), archive path traversal, and dangerous layer types during authorized penetration tests of AI/ML pipelines.Votes: 0GitHub stars: 2
- Webapp Exploiting Api Injection VulnerabilitiesTests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and…Votes: 0GitHub stars: 2
- Webapp Exploiting Broken Link HijackingDiscover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.Votes: 0GitHub stars: 2
- Webapp Exploiting Client Side Path TraversalExploiting Client-Side Path Traversal (CSPT, also known as On-Site Request Forgery) where attacker-controlled input is concatenated into a same-origin URL that the victim's browser fetches with their credentials, enabling CSPT-to-CSRF, cache deception/poisoning, and open-redirect-to-XSS/SSRF chains.Votes: 0GitHub stars: 2
- Webapp Exploiting Client Side Template InjectionExploiting Client-Side Template Injection (CSTI) where a frontend framework (AngularJS, Vue, Mavo, Alpine.js) compiles attacker-controlled template syntax in the browser, turning a reflection into arbitrary JavaScript execution (XSS) often bypassing classic XSS filters and CSP.Votes: 0GitHub stars: 2
- Webapp Exploiting Container EscapesEscaping Docker/containerd containers to the host during authorized engagements via privileged-container abuse (host disk mount, capabilities, nsenter), sensitive host mounts (docker.sock, /proc/sys/kernel/core_pattern, /proc/sysrq-trigger), the cgroup release_agent technique, and runc config.json…Votes: 0GitHub stars: 2
- Webapp Exploiting Cookie Based VulnerabilitiesTesting and exploiting cookie-related weaknesses including attribute misconfiguration (SameSite, HttpOnly, Secure, Domain, Path), cookie prefix bypasses (__Host-/__Secure-), parser-discrepancy attacks (cookie smuggling, sandwich, $Version legacy parsing), cookie tossing/fixation, and…Votes: 0GitHub stars: 2
- Webapp Exploiting Cross Site Script Inclusion XssiIdentifying and exploiting Cross-Site Script Inclusion (XSSI), where the script tag's exemption from the Same-Origin Policy lets an attacker include a victim endpoint cross-origin (with the victim's ambient cookies) and read sensitive data from static scripts, dynamic JS, JSONP responses, or…Votes: 0GitHub stars: 2
- Webapp Exploiting Csv Formula InjectionIdentifying and exploiting CSV/Excel formula (DDE) injection in import and export features where attacker-controlled data is written into spreadsheets and executed when opened in Excel or LibreOffice.Votes: 0GitHub stars: 2
- Webapp Exploiting Dangling Markup InjectionExploiting dangling markup / scriptless HTML injection to exfiltrate clear-text secrets, steal form data, subvert application flow, and bypass CSP when full XSS is not possible.Votes: 0GitHub stars: 2
- Webapp Exploiting Dbus And Socket Command InjectionEnumerating the D-Bus system bus and abusing root-exposed methods, policy and Polkit misconfigurations, and unix/abstract socket services for command injection and privilege escalation during authorized engagements, covering busctl/gdbus/dbus-send enumeration and exploitation plus root-owned UNIX…Votes: 0GitHub stars: 2
- Webapp Exploiting Dependency ConfusionIdentifying and exploiting dependency confusion (substitution) attacks where a package manager resolves an internal dependency name from a public registry instead of the intended private one, leading to attacker-controlled code execution at install time.Votes: 0GitHub stars: 2
- Webapp Exploiting Excessive Data Exposure In ApiTests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits.Votes: 0GitHub stars: 2
- Webapp Exploiting File Upload VulnerabilitiesIdentifying and exploiting insecure file upload functionality to achieve remote code execution, stored XSS, path traversal, and denial of service during authorized penetration tests.Votes: 0GitHub stars: 2
- Webapp Exploiting Http Request SmugglingDetecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.Votes: 0GitHub stars: 2
- Webapp Exploiting Idor VulnerabilitiesIdentifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.Votes: 0GitHub stars: 2
- Webapp Exploiting Insecure DeserializationIdentifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.Votes: 0GitHub stars: 2
- Webapp Exploiting Ldap InjectionExploiting LDAP injection where web applications build LDAP search filters from unsanitized user input, letting an attacker manipulate filter logic to bypass authentication, enumerate directory objects, and blind-extract attribute values such as passwords.Votes: 0GitHub stars: 2
- Webapp Exploiting Linux CapabilitiesEnumerating and abusing Linux capabilities (file and process) for local privilege escalation and container escape during authorized engagements, covering cap_setuid, cap_dac_read_search/override, cap_sys_admin, cap_sys_ptrace, cap_dac_override, cap_chown and ambient capability abuse.Votes: 0GitHub stars: 2
- Webapp Exploiting Macos Dyld Hijacking And Process InjectionExploiting macOS dynamic-linker and process-injection primitives during authorized engagements - DYLD_INSERT_LIBRARIES injection, @rpath/missing-dylib hijacking with re-export proxy libraries, dyld interposing and fishhook symbol rebinding, Objective-C method swizzling, and Mach task-port thread…Votes: 0GitHub stars: 2
- Webapp Exploiting Mass Assignment In Rest ApisDiscover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.Votes: 0GitHub stars: 2
- Webapp Exploiting Nosql Injection VulnerabilitiesDetect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.Votes: 0GitHub stars: 2
- Webapp Exploiting Oauth MisconfigurationIdentifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.Votes: 0GitHub stars: 2
- Webapp Exploiting Orm InjectionExploiting ORM injection (ORM Leak) where applications pass attacker-controlled keys/operators directly into ORM query builders (Django, Prisma, Beego, Ransack, Entity Framework/OData), letting attackers smuggle relational filters and comparison operators to leak hidden columns (passwords, reset…Votes: 0GitHub stars: 2
- Webapp Exploiting Os Command InjectionIdentifying and exploiting OS command injection vulnerabilities in web applications where user input is passed to a system shell, leading to arbitrary command execution.Votes: 0GitHub stars: 2
- Webapp Exploiting Postmessage VulnerabilitiesExploiting insecure cross-window messaging where senders use a wildcard targetOrigin (leaking sensitive data) or receivers register message handlers with missing/weak origin validation, enabling sensitive-message theft, DOM XSS, prototype-pollution-to-XSS, SOP bypass via null-origin iframes, and…Votes: 0GitHub stars: 2
- Webapp Exploiting Prototype Pollution In JavascriptDetect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.Votes: 0GitHub stars: 2
- Webapp Exploiting Reverse Tab NabbingIdentifying and exploiting reverse tabnabbing, where a link opened with target="_blank" without rel="noopener" gives the newly opened (attacker-controlled) page a reference to the originating window via window.opener, allowing it to redirect the original tab to a phishing clone.Votes: 0GitHub stars: 2
- Webapp Exploiting Saml Authentication FlawsIdentifying and exploiting SAML SSO weaknesses including XML Signature Wrapping (XSW1-8), comment injection in NameID, missing/stripped signatures, recipient and audience confusion, assertion replay, key confusion, and XXE in SAML messages to forge authentication and impersonate users.Votes: 0GitHub stars: 2
- Webapp Exploiting Server Side Includes Esi InjectionExploiting Server-Side Includes (SSI) and Edge-Side Includes (ESI) injection where unsanitized input is reflected into content processed by an SSI-enabled web server or an ESI-capable cache/proxy (Squid, Varnish, Fastly, Akamai, nodesi), enabling command execution, file inclusion, SSRF, cookie…Votes: 0GitHub stars: 2
- Webapp Exploiting Server Side Request ForgeryIdentifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.Votes: 0GitHub stars: 2
- Webapp Exploiting Sql Injection VulnerabilitiesIdentifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap.Votes: 0GitHub stars: 2
- Webapp Exploiting Sql Injection With SqlmapDetecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.Votes: 0GitHub stars: 2
- Webapp Exploiting Subdomain Takeover VulnerabilitiesIdentifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.Votes: 0GitHub stars: 2