Skip to content

Claude Skills by blacklanternsecurity

github.com/blacklanternsecurity

80 skillsA× 41B× 21C× 8D× 4F× 60 installs85 views

Deserialization JavaAExploit Java deserialization vulnerabilities during authorized penetration testing.securitypythonrustVotes: 0GitHub stars: 266
Deserialization PhpBExploit PHP deserialization vulnerabilities during authorized penetration testing.securitypythonrustVotes: 0GitHub stars: 266
File Upload BypassBGuide file upload restriction bypass during authorized penetration testing.securitypythonjavaVotes: 0GitHub stars: 266
IdorAExploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
Jwt AttacksCExploit JWT (JSON Web Token) vulnerabilities during authorized penetration testing.securitypythonrustVotes: 0GitHub stars: 266
Ldap InjectionAExploit LDAP injection vulnerabilities during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Skills DirectorySkills Directory Look up any of 103,619 scanned skills — grade, score, and every finding. Free.Check a skill
LfiDGuide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Nosql InjectionAGuide NoSQL injection exploitation during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
Oauth AttacksAExploit OAuth 2.0 and OpenID Connect vulnerabilities during authorized penetration testing.securitypythonrustVotes: 0GitHub stars: 266
Password Reset PoisoningAExploit password reset vulnerabilities during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Php Code InjectionBExploit PHP code evaluation injection via eval(), assert(), preg_replace /e, create_function(), call_user_func(), usort() callbacks, and runtime function creation (runkit, uopz). Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct PHP code evaluation of user input.securitygophpVotes: 0GitHub stars: 266
Python Code InjectionCExploit Python eval(), exec(), and compile() injection in web applications. Distinct from OS command injection (shell operators) and SSTI (template engines) — this targets direct Python code evaluation of user input.securitypythongoVotes: 0GitHub stars: 266
Race ConditionAExploit race conditions and TOCTOU vulnerabilities in web applications during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Request SmugglingBGuide HTTP request smuggling exploitation during authorized penetration testing.securitypythonrustVotes: 0GitHub stars: 266
Smb Share WebshellADeploy webshells to IIS, Apache, or Tomcat web roots via SMB share write access. Use when a domain user has write access to a file share that maps to a web server's document root — write a webshell via smbclient/net use, then trigger it via HTTP for RCE. Covers PHP, ASPX, and JSP webshells, .NET impersonation for same-host lateral movement, and internal site discovery.securitygojavaVotes: 0GitHub stars: 266
Source Code ReviewASecurity-focused source code review. Identifies hardcoded credentials, injection sinks, authentication weaknesses, and framework-specific vulnerabilities. Use when application source code is available for review.securityjavascriptpythonVotes: 0GitHub stars: 266
Sql Injection BlindAGuide blind SQL injection exploitation (boolean-based, time-based, and out-of-band) during authorized penetration testing.securityphpbashVotes: 0GitHub stars: 266
Sql Injection ErrorAGuide error-based SQL injection exploitation during authorized penetration testing.securityshellbashVotes: 0GitHub stars: 266
Sql Injection StackedBGuide stacked query SQL injection and second-order injection exploitation during authorized penetration testing.securityjavaphpVotes: 0GitHub stars: 266
Sql Injection UnionAGuide UNION-based SQL injection exploitation during authorized penetration testing.securityshellbashVotes: 0GitHub stars: 266
SsrfCGuide server-side request forgery (SSRF) exploitation during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Ssti FreemarkerBGuide Freemarker/Java server-side template injection exploitation during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
Ssti Jinja2BGuide Jinja2/Python server-side template injection exploitation during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Ssti TwigBGuide Twig/PHP server-side template injection exploitation during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266
Tomcat Manager DeployFDeploy WAR files via Apache Tomcat Manager for remote code execution. Use when Tomcat Manager is accessible with valid credentials (manager-script or manager-gui role). Covers WAR generation, deployment via text API and HTML interface, reverse shell delivery, and cleanup. Common initial access vector after credential discovery via LFI, default creds, or config file exposure.securitypythonjavaVotes: 0GitHub stars: 266
Web DiscoveryCDiscover web application injection points and route to the correct exploitation skill during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
Xss DomAGuide DOM-based XSS exploitation during authorized penetration testing.securityjavascriptrustVotes: 0GitHub stars: 266
Xss ReflectedAGuide reflected XSS exploitation during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
Xss StoredBGuide stored (persistent) and blind XSS exploitation during authorized penetration testing.securityjavascriptpythonVotes: 0GitHub stars: 266
XxeCGuide XML External Entity (XXE) injection exploitation during authorized penetration testing.securitypythongoVotes: 0GitHub stars: 266