All authors
Claude Skills by smartworldarafath
github.com/smartworldarafath182 skills0 installs0 views
- Offensive JwtJSON Web Token (JWT) security assessment covering alg:none rejection, RS256-to-HS256 algorithm confusion, weak HMAC secret entropy, jwk/jku/x5u header injection, kid path/SQL injection, exp/nbf/aud/iss claim validation, and token revocation architecture. Use when auditing stateless authentication tokens.Votes: 0GitHub stars: 5
- Offensive K8s AttacksKubernetes cluster security assessment covering RBAC wildcard/escalate permissions, Pod Security Standards (Restricted profile), ServiceAccount token automounting, etcd encryption, kubelet authentication, and CNI NetworkPolicies.Votes: 0GitHub stars: 5
- Offensive Keylogger ArchDefensive analysis and detection engineering for OS input capture APIs (`SetWindowsHookEx`, `GetAsyncKeyState`, RawInput, DirectInput, Linux evdev/uinput), focusing on UIPI privilege isolation and behavioral detection rules.Votes: 0GitHub stars: 5
- Offensive Krack Fragattacks802.11 supplicant and access point firmware vulnerability auditing for Key Reinstallation Attacks (KRACK) and Fragmentation/Aggregation vulnerabilities (FragAttacks), verifying CVE patch compliance across enterprise endpoints.Votes: 0GitHub stars: 5
- Offensive Lateral MovementInternal network segmentation and lateral-movement resilience assessment covering Windows Defender Credential Guard, Local Account Token Filter Policy, WinRM/WMI/RPC host firewall rules, and zero-trust bastion architecture.Votes: 0GitHub stars: 5
- Offensive Linux PrivescLinux local privilege boundary auditing covering SUID/SGID binaries, POSIX file capabilities (`getcap`), `sudoers` NOPASSWD/wildcard rules, writable systemd unit paths, cron job scripts, and kernel sysctl hardening.Votes: 0GitHub stars: 5
- Offensive Lorawan Sub GhzLoRaWAN and Sub-GHz ISM band protocol security assessment covering Over-The-Air Activation (OTAA v1.0.4/v1.1) vs ABP risks, root AppKey/NwkKey secure element storage, frame counter (FCnt) replay enforcement, and rolling-code cryptography.Votes: 0GitHub stars: 5
- Offensive MitigationsCross-platform binary hardening audit (`checksec`, `dumpbin`, `otool`) verifying Full RELRO, PIE/ASLR, Stack Canaries, `_FORTIFY_SOURCE=3`, Clang Control Flow Integrity (CFI), and SafeStack.Votes: 0GitHub stars: 5
- Offensive MobileAndroid (APK/AAB) and iOS (IPA) mobile security assessment aligned with OWASP MASVS covering exported components, deep-link validation, Keystore/Keychain vs plaintext storage, certificate pinning resilience, WebView hardening, and runtime integrity checks.Votes: 0GitHub stars: 5
- Offensive NetexecEnterprise Windows protocol auditing methodology covering SMB signing enforcement, LDAP signing and channel binding verification, NTLM relay mitigation, local administrator password uniqueness (LAPS), and segmentation verification across domain hosts.Votes: 0GitHub stars: 5
- Offensive Network AttacksLayer 2 and Layer 3 internal network security auditing covering Dynamic ARP Inspection (DAI), DHCP Snooping, 802.1X port authentication, disabling legacy name resolution (LLMNR, NBT-NS, mDNS), and VLAN trunk hardening.Votes: 0GitHub stars: 5
- Offensive OauthOAuth 2.0 and OpenID Connect (OIDC) security assessment covering exact redirect_uri matching, PKCE (S256) enforcement, state parameter CSRF binding, implicit flow deprecation, token leakage via Referer/history, and pre-account takeover during social login linking.Votes: 0GitHub stars: 5
- Offensive Open RedirectOpen redirect vulnerability assessment covering returnUrl/next parameter validation, protocol-relative URLs, backslash/authority confusion, OAuth redirect_uri token leakage chains, and strict origin allowlisting. Use when auditing login flows, OAuth callbacks, and external link routers.Votes: 0GitHub stars: 5
- Offensive Osint MethodologyRepeatable methodology for organization-wide attack-surface cataloging, correlating domains, IP ranges, TLS certificates, third-party SaaS dependencies, and automated drift alerting.Votes: 0GitHub stars: 5
- Offensive OsintAuthorized external attack-surface management (EASM) and asset inventory using Certificate Transparency (CT) logs, DNS/ASN mapping, public cloud asset enumeration, and git secret leak scanning.Votes: 0GitHub stars: 5
- Offensive Parameter PollutionHTTP Parameter Pollution (HPP) and JSON key duplication auditing across Express, Django, Flask, Spring, ASP.NET, and PHP backends, analyzing how front-end validators and back-end handlers resolve duplicate parameters. Use when auditing multi-layer validation and API gateways.Votes: 0GitHub stars: 5
- Offensive PersistenceDefensive hunting and baseline auditing of endpoint persistence surfaces across Windows (Registry Run keys, Scheduled Tasks, WMI Event Subscriptions, Services) and Linux (systemd units, cron, SSH authorized_keys, PAM modules).Votes: 0GitHub stars: 5
- Offensive PhishingEmail security and phishing-resilience auditing covering SPF hardfail (`-all`), DKIM 2048-bit key rotation, DMARC `p=reject` enforcement, MTA-STS, lookalike domain monitoring, and hardware-bound FIDO2/WebAuthn passkey adoption preventing AITM proxy theft.Votes: 0GitHub stars: 5
- Offensive Race ConditionWeb race condition and concurrency vulnerability assessment covering time-of-check to time-of-use (TOCTOU) windows, HTTP/2 single-packet concurrent request testing, coupon/balance double-spending, rate-limit bypasses, and remediation via database row locking (`SELECT FOR UPDATE`), idempotency keys, and distributed locks.Votes: 0GitHub stars: 5
- Offensive RceRemote Code Execution (RCE) and OS command injection auditing covering shell metacharacter injection, child_process/subprocess argument array separation, dynamic code evaluation sinks, expression language injection, and container sandboxing. Use when auditing code or endpoints that invoke system binaries or interpreters.Votes: 0GitHub stars: 5
- Offensive ReportingProfessional security assessment and vulnerability report authoring methodology covering risk-led executive summaries, CVSS v3.1/v4.0 vector scoring, CWE mapping, evidence redaction hygiene, root-cause explanation, and copy-paste remediation code.Votes: 0GitHub stars: 5
- Offensive Request SmugglingHTTP request smuggling and desynchronization auditing covering CL.TE, TE.CL, TE.TE obfuscation, HTTP/2 to HTTP/1.1 downgrade desync (H2.CL, H2.TE), header newline injection, and reverse-proxy/origin parser normalization. Use when auditing multi-tier load balancers, CDNs, and reverse proxy deployments.Votes: 0GitHub stars: 5
- Offensive ShellcodeReverse engineering and defensive analysis of position-independent code (PIC), PEB/TEB export resolution patterns, and verification of Arbitrary Code Guard (ACG), Control Flow Guard (CFG), and W^X memory protections.Votes: 0GitHub stars: 5
- Offensive Social EngineeringOrganizational identity-verification and helpdesk security auditing covering multi-party approval for MFA resets, out-of-band identity verification callbacks, badge access hygiene, and high-risk action approval workflows.Votes: 0GitHub stars: 5
- Offensive SqliSQL injection auditing and verification methodology covering error-based, boolean/time-based blind, out-of-band (OOB) detection, database-specific syntax differences (PostgreSQL, MySQL, MSSQL, Oracle, SQLite), second-order SQLi, ORM query builder pitfalls, and parameterized query remediation. Use when auditing web endpoints, database queries, or reviewing source code for SQL injection flaws.Votes: 0GitHub stars: 5
- Offensive SsrfServer-side request forgery (SSRF) assessment methodology covering URL parser differentials, DNS rebinding, redirect chains, cloud metadata protection (IMDSv2 enforcement), webhook fetchers, PDF/image renderers, and egress network allowlisting. Use when auditing server-side HTTP clients, webhooks, or URL preview features.Votes: 0GitHub stars: 5
- Offensive SstiServer-side template injection (SSTI) assessment covering Jinja2, Twig, Freemarker, Velocity, Pebble, Handlebars, and EJS template engines, context identification, sandbox escape analysis, and logic-less template remediation. Use when user input is concatenated into template strings or dynamic email/page rendering.Votes: 0GitHub stars: 5
- Offensive Supply ChainSoftware supply-chain security assessment aligned with SLSA covering deterministic lockfiles, `ignore-scripts` package policies, Sigstore/Cosign artifact signing, CycloneDX/SPDX SBOM generation, and transitive CVE reachability.Votes: 0GitHub stars: 5
- Offensive Tls AttacksTLS/SSL and PKI security configuration auditing covering TLS 1.2/1.3 cipher suite selection, forward secrecy (ECDHE), HSTS preload, Certificate Authority Authorization (CAA) DNS records, OCSP stapling, and mTLS validation.Votes: 0GitHub stars: 5
- Offensive ToctouTime-of-Check to Time-of-Use (TOCTOU) race condition auditing in privileged daemons, installers, and kernel drivers, covering symlink/oplock races, double-fetch bugs, and remediation with `openat2` and handle-based APIs.Votes: 0GitHub stars: 5
- Offensive Vuln ClassesDeep technical reference of software vulnerability classes mapped to CWE: integer truncation/wraparound, off-by-one, uninitialized memory, parser differentials, state machine desync, and cryptographic misuse.Votes: 0GitHub stars: 5
- Offensive Waf BypassWeb Application Firewall (WAF) rule evaluation and parser discrepancy testing covering character encoding normalization, multipart/chunked parsing differences, inspection body size limits, and defense-in-depth verification ensuring application-layer fixes do not rely solely on edge WAF rules.Votes: 0GitHub stars: 5
- Offensive Wifi ReconAuthorized wireless airspace inventory and telemetry analysis covering 2.4/5/6 GHz channel scanning, beacon/probe frame inspection, cipher suite enumeration, and unauthorized access point detection.Votes: 0GitHub stars: 5
- Offensive Wifi802.11 wireless security assessment entrypoint covering SSID architecture, encryption standards (WPA2, WPA3, OWE, 802.1X), guest network segmentation, Management Frame Protection (802.11w PMF), and authorized RF assessment planning.Votes: 0GitHub stars: 5
- Offensive Windows BoundariesWindows security boundary architecture analysis covering Mandatory Integrity Control (Low/Medium/High/System IL), AppContainer capability sandboxing, Service Hardening, and privileged RPC/ALPC/COM interface auditing.Votes: 0GitHub stars: 5
- Offensive Windows MitigationsWindows binary and OS mitigation verification covering High-Entropy ASLR, DEP/NX, Control Flow Guard (CFG), eXtended Flow Guard (XFG), Intel CET Hardware Shadow Stacks, ACG, and Hypervisor-Protected Code Integrity (HVCI).Votes: 0GitHub stars: 5
- Offensive Windows PrivescWindows local privilege boundary auditing covering service binary and registry key ACLs, unquoted service paths, DLL search-order hijacking, `AlwaysInstallElevated`, and token privilege assignment (`SeImpersonatePrivilege`, `SeDebugPrivilege`).Votes: 0GitHub stars: 5
- Offensive Wpa Enterprise802.1X WPA-Enterprise security assessment covering EAP method selection (EAP-TLS vs PEAP-MSCHAPv2/EAP-TTLS), supplicant RADIUS server certificate validation, TLS 1.3 enforcement, and VLAN/NAC post-authentication enforcement.Votes: 0GitHub stars: 5
- Offensive Wpa2 PskWPA2-PSK security assessment covering 4-way EAPOL handshake and RSN PMKID exposure analysis, passphrase entropy evaluation, PSK rotation constraints, and migration paths to WPA3-SAE or 802.1X.Votes: 0GitHub stars: 5
- Offensive Wpa3 SaeWPA3-Simultaneous Authentication of Equals (SAE) security assessment covering WPA2/WPA3 transition-mode downgrade risks, mandatory 802.11w PMF verification, H2E (Hash-to-Element) support, and supplicant firmware patching.Votes: 0GitHub stars: 5
- Offensive WpsWi-Fi Protected Setup (WPS) configuration auditing covering IE beacon flag inspection, offline/online PIN vulnerability verification, and hardware/firmware remediation to permanently disable WPS.Votes: 0GitHub stars: 5
- Offensive XssCross-site scripting (XSS) assessment methodology covering reflected, stored, DOM-based, and mutation XSS (mXSS), sink/source taint tracking, template context escaping, sanitizer bypass analysis, and Content-Security-Policy (CSP) hardening. Use when auditing frontend rendering, DOM sinks, rich-text sanitizers, or HTML output encoding.Votes: 0GitHub stars: 5
- Offensive XxeXML External Entity (XXE) vulnerability assessment covering external DTD loading, parameter entities, blind OOB entity resolution, SVG/DOCX/XLSX XML parsing surfaces, and secure XML parser flags (disabling DOCTYPE and external general/parameter entities). Use when auditing XML, SOAP, SAML, or document upload parsers.Votes: 0GitHub stars: 5
- Offensive Z WaveZ-Wave smart-home and building-automation protocol auditing covering S2 Elliptic Curve Diffie-Hellman (ECDH) DSK verification, prevention of legacy S0 zero-key downgrade during inclusion, and controller hardening.Votes: 0GitHub stars: 5
- Offensive Zigbee Thread MatterIEEE 802.15.4 mesh protocol security assessment covering Zigbee install-code key provisioning, Trust Center link key rotation, Thread commissioning security, and Matter device attestation certificates (DAC/PAA).Votes: 0GitHub stars: 5
- Payloads Api Key LeaksAPI keys and tokens are forms of authentication commonly used to manage permissions and access to both public and private services. Leaking these sensitive pieces of data can lead to unauthorized access, compromised security, and potential data breaches. - - General purpose vulnerability and misconfiguration scanner which also searches for API keys/secrets. - A library for detecting known or weak...Votes: 0GitHub stars: 5
- Payloads AtoAccount Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors. 1. Request password reset to your email address 2. Click on the password reset link 3. Don't change password 4. Click any 3rd party websites(e.g., Facebook, twitter) 5. Intercept the request in Burp Suite proxy 6. Check if the referer...Votes: 0GitHub stars: 5
- Payloads BizlogicBusiness logic errors, also known as business logic flaws, are a type of application vulnerability that stems from the application's business logic, which is the part of the program that deals with real-world business rules and processes. These rules could include things like pricing models, transaction limits, or the sequences of operations that need to be followed in a multi-step process....Votes: 0GitHub stars: 5
- Payloads BruteforceIP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare. Bruteforcing the phone number of any Google user while rotating IPv6 addresses. Fast web fuzzer written in Go. The class-leading vulnerability scanning, penetration testing, and web app security platform. A special build of curl that can impersonate Chrome & Firefox. In a web context, brute-forcing...Votes: 0GitHub stars: 5
- Payloads Cache DeceptionWeb Cache Deception (WCD) is a security vulnerability that occurs when a web server or caching proxy misinterprets a client's request for a web resource and subsequently serves a different resource, which may often be more sensitive or private, after caching it. Web Cache Poisoning Burp Extension Example of Web Cache Deception: Imagine an attacker lures a logged-in victim into accessing 1. The...Votes: 0GitHub stars: 5