All authors
Claude Skills by harezadmm
github.com/harezadmm182 skills0 installs5 views
- Classical Cipher AnalysisClassical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.Votes: 0GitHub stars: 2
- Claude HandoffHand the current conversation off to a fresh background agent that picks up the work immediately.Votes: 0GitHub stars: 2
- ClickjackingClickjacking and UI redressing — frame-embedding, X-Frame-Options gaps, and the click-hijack chainsVotes: 0GitHub stars: 2
- Cloud AssessmentMulti-cloud READ-ONLY security assessment methodology for AWS, Azure, and GCP using CIS benchmark-aligned checksVotes: 0GitHub stars: 2
- Cloudflare Waf Recon SurvivalWorking through Cloudflare and managed-WAF anti-automation during reconnaissance. Use when a scan is blocked by JS challenges, managed challenge pages, 1020 Access Denied, rate limiting, or bot score suppression. Covers diagnosis, the legitimate-client problem, and the escalation ladder that keeps recon useful.Votes: 0GitHub stars: 2
- Cmdi Command InjectionCommand injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.Votes: 0GitHub stars: 2
- Code Obfuscation DeobfuscationCode obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.Votes: 0GitHub stars: 2
- Code ReviewReview the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".Votes: 0GitHub stars: 2
- Container Escape TechniquesContainer escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.Votes: 0GitHub stars: 2
- Cors Cross Origin MisconfigurationCORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.Votes: 0GitHub stars: 2
- Credential Access Atomic TestsATT&CK Credential Access techniques with executable atomic tests. Use when hunting for credential material on a compromised host, dumping secrets, or validating credential-theft detection. Covers the 67 documented techniques across LSASS, SAM/NTDS, Kerberos, browser stores, cloud metadata, and password stores.Votes: 0GitHub stars: 2
- Credential List EngineeringBuilding and prioritising credential lists for authorised testing. Use when planning password-spraying, brute-force, or credential-stuffing campaigns, or when scoping authentication testing against lockout and detection. Covers attempt budgets, list provenance, the password-policy inverse, lockout arithmetic, and mutation rules.Votes: 0GitHub stars: 2
- Crlf InjectionCRLF injection — header splitting, response splitting, log injection, and request smuggling preconditionsVotes: 0GitHub stars: 2
- Csp Bypass AdvancedAdvanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.Votes: 0GitHub stars: 2
- Csrf Cross Site Request ForgeryCSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.Votes: 0GitHub stars: 2
- Csv Formula InjectionCSV formula injection — spreadsheet payload execution, DDE, and data exfiltration via exported filesVotes: 0GitHub stars: 2
- Dangling Markup InjectionDangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.Votes: 0GitHub stars: 2
- Data Breach Correlation WorkflowsBreach data correlation for authorisation-controlled testing. Use when assessing whether employee credentials are exposed through historical breaches, or building a credential strategy from breach intelligence. Covers the provenance hierarchy, validity assessment, and the legal constraints on using third-party breach data.Votes: 0GitHub stars: 2
- Defi Attack PatternsDeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.Votes: 0GitHub stars: 2
- Dependency ConfusionSupply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.Votes: 0GitHub stars: 2
- Deserialization InsecureInsecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.Votes: 0GitHub stars: 2
- Diagnosing BugsDiagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.Votes: 0GitHub stars: 2
- Dns Rebinding AttacksDNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.Votes: 0GitHub stars: 2
- Dorking Recon EnginesSearch-engine reconnaissance as a discipline, not a dork list. Use during the SCOUT phase or when hunting internet-exposed assets: the recon funnel, operator taxonomy, translating intelligence requirements into operator expressions, engine selection across Google, Bing, Yandex, Shodan, Censys, FOFA and ZoomEye, scope discipline, and confirming hits before reporting.Votes: 0GitHub stars: 2
- Ebpf AttackseBPF-based post-exploitation for kernel-level credential harvesting, process hiding, and traffic interception on LinuxVotes: 0GitHub stars: 2
- Edr Bypass TechniquesEvading endpoint detection and response. Use in an authorised red-team engagement when a payload is being detected, or when validating whether an EDR deployment actually provides coverage. Covers the detection layers, the bypass per layer, and the honest limits of each.Votes: 0GitHub stars: 2
- Email Header InjectionEmail header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.Votes: 0GitHub stars: 2
- Expression Language InjectionExpression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.Votes: 0GitHub stars: 2
- File Access VulnEntry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.Votes: 0GitHub stars: 2
- Format String ExploitationFormat string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.Votes: 0GitHub stars: 2
- Gcp PostexploitGCP post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via google-cloud SDKVotes: 0GitHub stars: 2
- Ghost Bits Cast AttackJava "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVE...Votes: 0GitHub stars: 2
- Grabber Auto Extraction EngineAutomated data extraction from discovered artefacts at scale. Use when a crawl, breach corpus, or post-access haul produces thousands of raw files and the task is reducing them to verifiable findings. Covers the reduction funnel, normalisation, content deduplication, placeholder control, scoring, and the verification loop that keeps hypotheses out of reports.Votes: 0GitHub stars: 2
- Graphql And Hidden ParametersGraphQL and hidden parameter testing playbook. Use when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Covers schema recovery when introspection is disabled, field-suggestion mining, alias and batching abuse, depth and complexity attacks, authorization gaps at field level, and the evidence required to report each class distinctly.Votes: 0GitHub stars: 2
- Graphql Exploitation ChainsGraphQL-specific vulnerabilities and exploitation. Use when a GraphQL endpoint is found and the task is introspection, authorization bypass, injection, or denial of service. Covers schema discovery, field-level authorization failure, and the batching and depth attack surface.Votes: 0GitHub stars: 2
- HackEntry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.Votes: 0GitHub stars: 2
- HandoffCompact the current conversation into a handoff document for another agent to pick up.Votes: 0GitHub stars: 2
- Hash Attack TechniquesHash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.Votes: 0GitHub stars: 2
- Http Host Header AttacksHTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.Votes: 0GitHub stars: 2
- Http Parameter PollutionHTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.Votes: 0GitHub stars: 2
- Http2 Specific AttacksHTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.Votes: 0GitHub stars: 2
- Idor Broken Object AuthorizationIDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.Votes: 0GitHub stars: 2
- Infrastructure Network PentestingNetwork and infrastructure penetration testing. Use when the engagement covers hosts, network devices, or segmented internal networks rather than a web application. Covers segmentation analysis, protocol-level attacks, network device testing, and infrastructure pivot paths.Votes: 0GitHub stars: 2
- Injection CheckingEntry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.Votes: 0GitHub stars: 2
- Insecure Source Code ManagementInsecure source code management — exposed repositories, leaked secrets, and history miningVotes: 0GitHub stars: 2
- Ios Pentesting TricksiOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.Votes: 0GitHub stars: 2
- Jndi InjectionJNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().Votes: 0GitHub stars: 2
- Jwt Oauth Token AttacksJWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.Votes: 0GitHub stars: 2
- K8s AssessmentKubernetes security assessment playbook. Use when probing an API server, kubelet, etcd, dashboard, or ingress surface from outside or with limited credentials. Covers unauthenticated /version and /api probes, anonymous auth and system:anonymous bindings, the system:unauthenticated group, kubelet 10250/10255 exec and log endpoints, etcd exposure, dashboard and ingress misconfiguration, RBAC enumeration with kubectl auth can-i --list, service-account token hunting, secret decoding, admission-co...Votes: 0GitHub stars: 2
- K8s PostexploitKubernetes post-exploitation playbook. Use after a pod foothold or captured kubeconfig to enumerate permissions, extract Secrets and registry credentials, escalate via privileged pods, hostPath, hostPID/hostNetwork and capabilities, escape through docker.sock, write to the node filesystem, harvest node and cloud IAM credentials via IMDS, pivot into the cloud account, abuse service account tokens against the API server, and persist for reporting.Votes: 0GitHub stars: 2