All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Securing Azure With Microsoft DefenderThis skill instructs security practitioners on deploying Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments.Votes: 0GitHub stars: 2
- Webapp Securing Container Registry ImagesSecuring container registry images by implementing vulnerability scanning with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring registry access controls, and building CI/CD pipelines that prevent deploying unscanned or unsigned images.Votes: 0GitHub stars: 2
- Webapp Securing Container Registry With HarborHarbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies…Votes: 0GitHub stars: 2
- Webapp Securing Github Actions WorkflowsThis skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation.Votes: 0GitHub stars: 2
- Webapp Securing Helm Chart DeploymentsSecure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.Votes: 0GitHub stars: 2
- Webapp Securing Historian Server In Ot EnvironmentThis skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments.Votes: 0GitHub stars: 2
- Webapp Securing Kubernetes On CloudThis skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring.Votes: 0GitHub stars: 2
- Webapp Securing Remote Access To Ot EnvironmentThis skill covers implementing secure remote access to OT/ICS environments for operators, engineers, and vendors while preventing unauthorized access that could compromise industrial operations.Votes: 0GitHub stars: 2
- Webapp Security Control Differential TestingFind security-relevant interpretation gaps between layers - client, CDN, WAF, reverse proxy, API gateway, application, framework - using path normalization, method, encoding, header, and version differentials. The goal is a control that one layer honors and another ignores, not generic WAF bypass.Votes: 0GitHub stars: 2
- Webapp Soap Api SecuritySOAP web service security testing — WSDL analysis, XXE and XML injection, SOAPAction spoofing, WS-Security bypass, XPath injection, and entity-expansion abuse with fault-and-data differential…Votes: 0GitHub stars: 2
- Webapp Source Assisted AnalysisUse attached source code as a SECONDARY accelerator for black-box testing - work the auto-seeded source-to-route ledger first, trace call paths before claiming a sink is reachable, find hidden routes and extra hypotheses, and correlate confirmed runtime behavior back to code.Votes: 0GitHub stars: 2
- Webapp StandardBalanced security assessment with systematic methodology and full attack surface…Votes: 0GitHub stars: 2
- Webapp Subdomain EnumerationMulti-source subdomain discovery combining passive (CT, aggregators) and active (DNS brute-force) techniques with takeover…Votes: 0GitHub stars: 2
- Webapp Technology FingerprintingDeep technology stack identification including frameworks, CDNs, WAFs, and server-side runtimes.Votes: 0GitHub stars: 2
- Webapp Testing Api Authentication WeaknessesTests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws.Votes: 0GitHub stars: 2
- Webapp Testing Api For Broken Object Level AuthorizationTests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users to check whether the server enforces per-object…Votes: 0GitHub stars: 2
- Webapp Testing Api For Mass Assignment VulnerabilityTests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocumented fields to request bodies (role, isAdmin, price, balance), and checking whether the server binds them to the data model without filtering.Votes: 0GitHub stars: 2
- Webapp Testing Api Security With Owasp Top 10Systematically assessing REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.Votes: 0GitHub stars: 2
- Webapp Testing Cors MisconfigurationIdentifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.Votes: 0GitHub stars: 2
- Webapp Testing Ecommerce And Payment LogicTesting business-logic flaws in e-commerce and payment flows including price/product tampering, quantity abuse, voucher and gift-card manipulation, cart and shipping IDOR, payment-method and amount tampering, currency swaps, refund manipulation, and out-of-stock ordering.Votes: 0GitHub stars: 2
- Webapp Testing For Crlf InjectionTesting web applications for CRLF (Carriage Return / Line Feed) injection where unsanitized %0d%0a sequences in user input let an attacker inject HTTP headers, split responses, poison caches, plant cookies, or pivot to XSS and request smuggling.Votes: 0GitHub stars: 2
- Webapp Testing For Email Header InjectionTest web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.Votes: 0GitHub stars: 2
- Webapp Testing For Host Header InjectionTest web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.Votes: 0GitHub stars: 2
- Webapp Testing For Json Web Token VulnerabilitiesTest JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.Votes: 0GitHub stars: 2
- Webapp Testing For Regex Dos RedosTesting web applications for Regular Expression Denial of Service (ReDoS), where crafted input forces a backtracking regex engine into super-linear (polynomial or exponential) processing time, hanging worker threads and causing denial of service.Votes: 0GitHub stars: 2
- Webapp Testing For Sensitive Data ExposureIdentifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.Votes: 0GitHub stars: 2
- Webapp Testing For Xml Injection VulnerabilitiesTest web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.Votes: 0GitHub stars: 2
- Webapp Testing For Xss Vulnerabilities With BurpsuiteIdentifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.Votes: 0GitHub stars: 2
- Webapp Testing For Xss VulnerabilitiesTests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation.Votes: 0GitHub stars: 2
- Webapp Testing For Xxe Injection VulnerabilitiesDiscovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.Votes: 0GitHub stars: 2
- Webapp Testing Jwt Token SecurityAssessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.Votes: 0GitHub stars: 2
- Webapp Testing Llm Prompt Injection And JailbreaksTesting LLM-backed applications, chatbots, and AI agents for direct and indirect prompt injection, jailbreaks, system-prompt leakage, and tool/agent abuse during authorized penetration tests, using structured payload families and reliable confirmation signals.Votes: 0GitHub stars: 2
- Webapp Testing Mcp Server SecurityTesting Model Context Protocol (MCP) servers and the clients that consume them for tool poisoning, prompt injection via tool descriptions/outputs, over-permissioned and local-credential-stealing tools, config/trust bypasses, and unauthenticated RCE during authorized penetration tests of AI agent…Votes: 0GitHub stars: 2
- Webapp Testing Password Reset FlawsIdentifying and exploiting weaknesses in password reset flows including weak reset tokens, host header poisoning, IDOR on the identification parameter, missing session invalidation, and account enumeration.Votes: 0GitHub stars: 2
- Webapp Testing Ransomware Recovery ProceduresTest and validate ransomware recovery procedures including backup restore operations, RTO/RPO target verification, recovery sequencing, and clean restore validation to ensure organizational resilience against destructive ransomware attacks.Votes: 0GitHub stars: 2
- Webapp Testing Registration And Account FlawsIdentifying and exploiting weaknesses in account registration including duplicate/overwrite registration, weak password policy, missing email verification, disposable email acceptance, route-clobbering usernames, pre-account-takeover, and role mass-assignment.Votes: 0GitHub stars: 2
- Webapp Testing Websocket Api SecurityTests WebSocket API implementations for missing upgrade-handshake authentication, Cross-Site WebSocket Hijacking (CSWSH), message injection, insufficient input validation, message-flooding DoS, and information leakage, using Burp Suite's WebSocket interception and the wscat CLI to craft malicious…Votes: 0GitHub stars: 2
- Webapp Thick ClientSecurity testing for desktop thick-client applications and local IPC communication.Votes: 0GitHub stars: 2
- Webapp Tracking Threat Actor InfrastructureThreat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting…Votes: 0GitHub stars: 2
- Webapp Triaging Security Alerts In SplunkTriages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard.Votes: 0GitHub stars: 2
- Webapp Triaging Security Incident With Ir PlaybookClassify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.Votes: 0GitHub stars: 2
- Webapp Triaging Security IncidentPerforms initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams.Votes: 0GitHub stars: 2
- Webapp Triaging Vulnerabilities With Ssvc FrameworkTriage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.Votes: 0GitHub stars: 2
- Webapp Web App Penetration TestingPentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept…Votes: 0GitHub stars: 2
- Webapp Web Offensive Business LogicBusiness logic vulnerability testing for web/mobile/API engagements.Votes: 0GitHub stars: 2
- Webapp Web Offensive DeserializationInsecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby.Votes: 0GitHub stars: 2
- Webapp Web Offensive File UploadFile upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.Votes: 0GitHub stars: 2
- Webapp Web Offensive GraphqlOffensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements.Votes: 0GitHub stars: 2
- Webapp Web Offensive IdorIDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.Votes: 0GitHub stars: 2
- Webapp Web Offensive Open RedirectOpen redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.Votes: 0GitHub stars: 2