All authors
Claude Skills by smartworldarafath
github.com/smartworldarafath182 skills0 installs0 views
- Payloads ClickjackingClickjacking is a type of web security vulnerability where a malicious website tricks a user into clicking on something different from what the user perceives, potentially causing the user to perform unintended actions without their knowledge or consent. Users are tricked into performing all sorts of unintended actions as such as typing in the password, clicking on ‘Delete my account' button,...Votes: 0GitHub stars: 5
- Payloads CmdiCommand injection is a security vulnerability that allows an attacker to execute arbitrary commands inside a vulnerable application. Automated All-in-One OS command injection and exploitation tool An OOB interaction gathering server and client library Command injection, also known as shell injection, is a type of attack in which the attacker can execute arbitrary commands on the host operating...Votes: 0GitHub stars: 5
- Payloads CorsA site-wide CORS misconfiguration was in place for an API domain. This allowed an attacker to make cross origin requests on behalf of the user as the application did not whitelist the Origin header and had Access-Control-Allow-Credentials: true meaning we could make requests from our attacker's site using the victim's credentials. CORS Misconfiguration Scanner Fast CORS misconfiguration...Votes: 0GitHub stars: 5
- Payloads CrlfCRLF Injection is a web security vulnerability that arises when an attacker injects unexpected Carriage Return (CR) (\r) and Line Feed (LF) (\n) characters into an application. These characters are used to signify the end of a line and the start of a new one in network protocols like HTTP, SMTP, and others. In the HTTP protocol, the CR-LF sequence is always used to terminate a line. HTTP Response...Votes: 0GitHub stars: 5
- Payloads CsptClient-Side Path Traversal (CSPT), sometimes also referred to as 'On-site Request Forgery,' is a vulnerability that can be exploited as a tool for CSRF or XSS attacks. It takes advantage of the client side's ability to make requests using fetch to a URL, where multiple '../' characters can be injected. After normalization, these characters redirect the request to a different URL, potentially...Votes: 0GitHub stars: 5
- Payloads CsrfCross-Site Request Forgery (CSRF/XSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. - OWASP The Prime Cross Site Request Forgery Audit and Exploitation Toolkit. When...Votes: 0GitHub stars: 5
- Payloads Css InjectionCSS Injection is a vulnerability that occurs when an application allows untrusted CSS to be injected into a web page. This can be exploited to exfiltrate sensitive data, such as CSRF tokens or other secrets, by manipulating the page layout or triggering network requests based on element attributes. A tool to exfiltrate unknown web pages using Blind CSS. Collection of CSS based exfiltration...Votes: 0GitHub stars: 5
- Payloads CsvMany web applications allow the user to download content such as templates for invoices or user settings to a CSV file. Many users choose to open the CSV file in either Excel, Libre Office or Open Office. When a web application does not properly validate the contents of the CSV file, it could lead to contents of a cell or many cells being executed. CSV Injection, also known as Formula Injection,...Votes: 0GitHub stars: 5
- Payloads CveA CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a publicly known cybersecurity vulnerability. CVEs help standardize the naming and tracking of vulnerabilities, making it easier for organizations, security professionals, and software vendors to share information and manage risks associated with these vulnerabilities. Each CVE entry includes a brief description of...Votes: 0GitHub stars: 5
- Payloads Dep ConfusionA dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository instead of the intended file of the same name from an internal repository. Tool to check for dependency confusion vulnerabilities in multiple package management systems Tool used to find dependency confusion or project...Votes: 0GitHub stars: 5
- Payloads DeserialSerialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them to storage, or to send as part of communications. Deserialization is the reverse of that process -- taking data structured from some format, and rebuilding it into an object - OWASP Check the following sub-sections, located in other chapters :...Votes: 0GitHub stars: 5
- Payloads Dns RebindingDNS rebinding changes the IP address of an attacker controlled machine name to the IP address of a target application, bypassing the and thus allowing the browser to make arbitrary requests to the target application and read their responses. A DNS rebinding attack framework. Singularity of Origin Web Client. Simple DNS Rebinding Service rbndr Tool Helper Setup Phase: Register a malicious domain...Votes: 0GitHub stars: 5
- Payloads Dom ClobberingDOM Clobbering is a technique where global variables can be overwritten or 'clobbered' by naming HTML elements with certain IDs or names. This can cause unexpected behavior in scripts and potentially lead to security vulnerabilities. - Comprehensive List of DOM Clobbering Payloads for Mobile and Desktop Web Browsers - A web-based tool designed for testing various HTML parsers and sanitizers. -...Votes: 0GitHub stars: 5
- Payloads EncodingEncoding and Transformations are techniques that change how data is represented or transferred without altering its core meaning. Common examples include URL encoding, Base64, HTML entity encoding, and Unicode transformations. Attackers use these methods as gadgets to bypass input filters, evade web application firewalls, or break out of sanitization routines. Unicode is a universal character...Votes: 0GitHub stars: 5
- Payloads Ext VarExternal Variable Modification Vulnerability occurs when a web application improperly handles user input, allowing attackers to overwrite internal variables. In PHP, functions like extract($GET), extract($POST), or importrequestvariables() can be abused if they import user-controlled data into the global scope without proper validation. This can lead to security issues such as unauthorized...Votes: 0GitHub stars: 5
- Payloads File UploadUploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code. File upload vulnerability scanner and exploitation tool. HTTP file upload scanner for Burp Proxy. OWASP ZAP add-on for finding vulnerabilities in File Upload functionality. Here is a list of...Votes: 0GitHub stars: 5
- Payloads GraphqlGraphQL is a query language for APIs and a runtime for fulfilling those queries with existing data. A GraphQL service is created by defining types and fields on those types, then providing functions for each field on each type - - - - - - - - - Scripting engine to interact with a graphql endpoint for pentesting purposes - GraphQL Security Research Material - A Burp Extension for GraphQL Security...Votes: 0GitHub stars: 5
- Payloads GwtGoogle Web Toolkit (GWT), also known as GWT Web Toolkit, is an open-source set of tools that allows web developers to create and maintain JavaScript front-end applications using Java. It was originally developed by Google and had its initial release on May 16, 2006. GWTMap is a tool to help map the attack surface of Google Web Toolkit (GWT) based applications. A set of tools made to assist in...Votes: 0GitHub stars: 5
- Payloads HeadlessA headless browser is a web browser without a graphical user interface. It works just like a regular browser, such as Chrome or Firefox, by interpreting HTML, CSS, and JavaScript, but it does so in the background, without displaying any visuals. Headless browsers are primarily used for automated tasks, such as web scraping, testing, and running scripts. They are particularly useful in situations...Votes: 0GitHub stars: 5
- Payloads Hidden ParamsWeb applications often have hidden or undocumented parameters that are not exposed in the user interface. Fuzzing can help discover these parameters, which might be vulnerable to various attacks. Burp extension to identify hidden, unlinked parameters. HTTP parameter discovery suite Hidden parameters discovery suite Fetch all the URLs that the Wayback Machine knows about for a domain Mining URLs...Votes: 0GitHub stars: 5
- Payloads HppHTTP Parameter Pollution (HPP) is a Web attack evasion technique that allows an attacker to craft a HTTP request in order to manipulate web logics or retrieve hidden information. This evasion technique is based on splitting an attack vector between multiple instances of a parameter with the same name (?param1=value¶m1=value). As there is no formal way of parsing HTTP parameters, individual...Votes: 0GitHub stars: 5
- Payloads IdorInsecure Direct Object References (IDOR) is a security vulnerability that occurs when an application allows users to directly access or modify objects (such as files, database records, or URLs) based on user-supplied input, without sufficient access controls. This means that if a user changes a parameter value (like an ID) in a URL or API request, they might be able to access or manipulate data...Votes: 0GitHub stars: 5
- Payloads Insecure RandomInsecure randomness refers to the weaknesses associated with random number generation in computing, particularly when such randomness is used for security-critical purposes. Vulnerabilities in random number generators (RNGs) can lead to predictable outputs that can be exploited by attackers, resulting in potential data breaches or unauthorized access. Insecure randomness arises when the source of...Votes: 0GitHub stars: 5
- Payloads Java RmiJava RMI (Remote Method Invocation) is a Java API that allows an object running in one JVM (Java Virtual Machine) to invoke methods on an object running in another JVM, even if they're on different physical machines. RMI provides a mechanism for Java-based distributed computing. siberas JMX exploitation toolkit MOGWAI LABS JMX exploitation toolkit Java RMI Vulnerability Scanner JMX enumeration...Votes: 0GitHub stars: 5
- Payloads JwtJSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. - - - - - - - 🐍 A toolkit for testing, tweaking and cracking JSON Web Tokens - JWT brute force cracker written in C - JavaScript Object Signing and...Votes: 0GitHub stars: 5
- Payloads LatexLaTeX Injection is a type of injection attack where malicious content is injected into LaTeX documents. LaTeX is widely used for document preparation and typesetting, particularly in academia, for producing high-quality scientific and mathematical documents. Due to its powerful scripting capabilities, LaTeX can be exploited by attackers to execute arbitrary commands if proper safeguards are not...Votes: 0GitHub stars: 5
- Payloads LdapLDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. LDAP Injection is a vulnerability that occurs when user-supplied input is used to construct LDAP queries without proper sanitization or escaping Attempt to...Votes: 0GitHub stars: 5
- Payloads Lfi RfiA File Inclusion Vulnerability refers to a type of security vulnerability in web applications, particularly prevalent in applications developed in PHP, where an attacker can include a file, usually exploiting a lack of proper input/output sanitization. This vulnerability can lead to a range of malicious activities, including code execution, data theft, and website defacement. - - - - - (archived...Votes: 0GitHub stars: 5
- Payloads Mass AssignmentA mass assignment attack is a security vulnerability that occurs when a web application automatically assigns user-supplied input values to properties or variables of a program object. This can become an issue if a user is able to modify attributes they should not have access to, like a user's permissions or an admin flag. Mass assignment vulnerabilities are most common in web applications that...Votes: 0GitHub stars: 5
- Payloads MethodologyPenetration testing methodology cheatsheets from PayloadsAllTheThings covering Active Directory, Cloud (AWS/Azure/GCP), network pivoting, reverse shells, C2 frameworks, and structured pentest engagement resources.Votes: 0GitHub stars: 5
- Payloads Mgmt InterfaceInsecure Management Interface refers to vulnerabilities in administrative interfaces used for managing servers, applications, databases, or network devices. These interfaces often control sensitive settings and can have powerful access to system configurations, making them prime targets for attackers. Insecure Management Interfaces may lack proper security measures, such as strong authentication,...Votes: 0GitHub stars: 5
- Payloads NosqliNoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax. Automated NoSQL database enumeration and web...Votes: 0GitHub stars: 5
- Payloads OauthOAuth is a widely-used authorization framework that allows third-party applications to access user data without exposing user credentials. However, improper configuration and implementation of OAuth can lead to severe security vulnerabilities. This document explores common OAuth misconfigurations, potential attack vectors, and best practices for mitigating these risks. Do you have HTML injection...Votes: 0GitHub stars: 5
- Payloads Open RedirectUn-validated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the...Votes: 0GitHub stars: 5
- Payloads Orm LeakAn ORM leak vulnerability occurs when sensitive information, such as database structure or user data, is unintentionally exposed due to improper handling of ORM queries. This can happen if the application returns raw error messages, debug information, or allows attackers to manipulate queries in ways that reveal underlying data. The following code is a basic example of an ORM querying the...Votes: 0GitHub stars: 5
- Payloads Path TraversalPath Traversal, also known as Directory Traversal, is a type of security vulnerability that occurs when an attacker manipulates variables that reference files with “dot-dot-slash (../)” sequences or similar constructs. This can allow the attacker to access arbitrary files and directories stored on the file system. The Directory Traversal Fuzzer We can use the characters to access the parent...Votes: 0GitHub stars: 5
- Payloads Prompt InjectionA technique where specific prompts or cues are inserted into the input data to guide the output of a machine learning model, specifically in the field of natural language processing (NLP). Simple list of tools that can be targeted by 'Prompt Injection'. They can also be used to generate interesting prompts. List of 'payloads' prompts Prompt Injections Everywhere LLM vulnerability scanner Tools to...Votes: 0GitHub stars: 5
- Payloads Proto PollutionPrototype pollution is a type of vulnerability that occurs in JavaScript when properties of Object.prototype are modified. This is particularly risky because JavaScript objects are dynamic and we can add properties to them at any time. Also, almost all objects in JavaScript inherit from Object.prototype, making it a potential attack vector. Help you find gadget for prototype pollution...Votes: 0GitHub stars: 5
- Payloads Race ConditionRace conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server, or programming language. - - - - a Burp Suite extension for sending large numbers of HTTP requests and...Votes: 0GitHub stars: 5
- Payloads RegexRegular Expression Denial of Service (ReDoS) is a type of attack that exploits the fact that certain regular expressions can take an extremely long time to process, causing applications or services to become unresponsive or crash. A CLI and library which tests with certainty if a regex pattern is safe from ReDoS attacks. Supported in the browser, Node and Deno. Find regular expressions which are...Votes: 0GitHub stars: 5
- Payloads Reverse ProxyA reverse proxy is a server that sits between clients and backend servers, forwarding client requests to the appropriate server while hiding the backend infrastructure and often providing load balancing or caching. Misconfigurations in a reverse proxy, such as improper access controls, lack of input sanitization in proxypass directives, or trusting client-provided headers like X-Forwarded-For,...Votes: 0GitHub stars: 5
- Payloads SamlSAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. While SAML is widely used to facilitate single sign-on (SSO) and other federated authentication scenarios, improper implementation or misconfiguration can expose systems to various vulnerabilities....Votes: 0GitHub stars: 5
- Payloads Scm ExposureInsecure Source Code Management (SCM) can lead to several critical vulnerabilities in web applications and services. Developers often rely on SCM systems like Git and Subversion (SVN) to manage their source code versions. However, poor security practices, such as leaving .git and .svn folders in production environments exposed to the internet, can pose significant risks. Exposing the version...Votes: 0GitHub stars: 5
- Payloads SmugglingHTTP Request smuggling occurs when multiple 'things' process a request, but differ on how they determine where the request starts/ends. This disagreement can be used to interfere with another user's request/response or to bypass security controls. It normally occurs due to prioritising different HTTP headers (Content-Length vs Transfer-Encoding), differences in handling malformed headers (eg...Votes: 0GitHub stars: 5
- Payloads SqliSQL Injection (SQLi) is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. SQL Injection is one of the most common and severe types of web application vulnerabilities, enabling attackers to execute arbitrary SQL code on the database. This can lead to unauthorized data access, data manipulation, and, in some cases, full...Votes: 0GitHub stars: 5
- Payloads SsiServer Side Includes (SSI) are directives that are placed in HTML pages and evaluated on the server while the pages are being served. They let you add dynamically generated content to an existing HTML page, without having to serve the entire page via a CGI program, or other dynamic technology. Automatic SSTI detection tool with interactive interface based on , supports SSI detection and...Votes: 0GitHub stars: 5
- Payloads SsrfServer Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf. Automatic SSRF fuzzer and exploitation tool Generates gopher link for exploiting SSRF and gaining RCE in various servers Python based scanner to find potential SSRF parameters Simple SSRF-testing sheriff written in Go Returns a list of viable SSRF candidates A...Votes: 0GitHub stars: 5
- Payloads SstiTemplate injection allows an attacker to include template code into an existing (or not) template. A template engine makes designing HTML pages easier by using static template files which at runtime replaces variables/placeholders with actual values in the HTML pages. - - - - - - - - An efficient SSTI + CSTI scanner which utilizes novel polyglots - Server-Side Template Injection and Code...Votes: 0GitHub stars: 5
- Payloads TabnabbingReverse tabnabbing is an attack where a page linked from the target page is able to rewrite that page, for example to replace it with a phishing site. As the user was originally on the correct page they are less likely to notice that it has been changed to a phishing site, especially if the site looks the same as the target. If the user authenticates to this new page then their credentials (or...Votes: 0GitHub stars: 5
- Payloads Type JugglingPHP is a loosely typed language, which means it tries to predict the programmer's intent and automatically converts variables to different types whenever it seems necessary. For example, a string containing only numbers can be treated as an integer or a float. However, this automatic conversion (or type juggling) can lead to unexpected results, especially when comparing variables using the '=='...Votes: 0GitHub stars: 5