All authors
Claude Skills by bitbytelabio
github.com/bitbytelabio1,113 skills0 installs0 views
- Webapp Web Offensive Parameter PollutionHTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.Votes: 0GitHub stars: 2
- Webapp Web Offensive Race ConditionRace condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.Votes: 0GitHub stars: 2
- Webapp Web Offensive RceRemote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery.Votes: 0GitHub stars: 2
- Webapp Web Offensive Request SmugglingHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.Votes: 0GitHub stars: 2
- Webapp Web Offensive SqliSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi.Votes: 0GitHub stars: 2
- Webapp Web Offensive SsrfServer-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.Votes: 0GitHub stars: 2
- Webapp Web Offensive SstiDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190.Votes: 0GitHub stars: 2
- Webapp Web Offensive Waf BypassWAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.Votes: 0GitHub stars: 2
- Webapp Web Offensive XssCross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.Votes: 0GitHub stars: 2
- Webapp Web Offensive XxeXML External Entity injection testing checklist: classic XXE, blind XXE (out-of-band), XXE via file upload (SVG/docx), XXE in SOAP/REST, error-based XXE, XInclude attacks, and XXE filter bypass. Use for web app XXE testing and bug bounty.Votes: 0GitHub stars: 2
- Webapp Web Surface DiscoveryWeb crawling and attack-surface mapping including links, forms, redirects, sitemap, and browser-derived endpoints.Votes: 0GitHub stars: 2
- Webapp Websocket Api SecurityWebSocket API security testing — upgrade authentication and Origin/CSWSH hijacking, per-message authorization bypass, frame injection, token lifecycle on reconnect, and unthrottled resource consumption on the WS…Votes: 0GitHub stars: 2
- Webapp Workflow State Machine TestingTreat multi-step application flows as state machines and abuse them - step skipping, step replay, reverse ordering, cross-session and cross-account token reuse, stale-state replay, and alternate-endpoint state checks across web, mobile, legacy, and GraphQL routes.Votes: 0GitHub stars: 2