All authors
Claude Skills by UnboundCompute
github.com/UnboundCompute194 skills6 installs758 views
- Auditing Ios App Group And Pasteboard ExposureAudit sensitive data leaving an iOS app's protection through shared containers and system-wide channels, where a secret or private value is written to a shared app-group container, a shared keychain access group, the general pasteboard, or app state that lands in snapshots and extensions, so another app, an app extension, or any process reading the pasteboard can recover it, because the shared surface is broader than the data's sensitivity requires. Use when reviewing what an iOS app shares w...Votes: 0GitHub stars: 5
- Auditing Jit Provisioning And Role MappingAudit just-in-time account provisioning at federated (SAML or OIDC) login for trust misplaced in the assertion that drives it: a first login that creates an account and assigns roles from identity-provider claims (groups, email domain, department) the service never validates, a claim-to-role mapping that grants more privilege than the claim should or defaults new users into a privileged role, an email or domain claim trusted to auto-join a tenant so an attacker with a lookalike address lands ...Votes: 0GitHub stars: 5
- Auditing Machine Identity IssuanceAudit how a platform issues machine and workload identities (certificate authorities, workload-identity federation, service-mesh identity, attestation-based credentialing) for trust misplaced in the thing asking for one: a credential issued on a weak or forgeable proof (a self-asserted name, an unvalidated label, a reachable metadata endpoint) so forging the proof yields a real identity, an issuing authority not constrained to the names it may mint, a federation trust configured so broadly (a...Votes: 0GitHub stars: 5
- Auditing Mfa Enrollment And Reset AbuseAudit multi-factor authentication enrollment, reset, and recovery for paths that let an attacker add their own factor or bypass the check: a first-factor session that can enroll a new authenticator without re-proving identity so a stolen password adds a second factor, an MFA reset or recovery flow guarded only by a weak signal (an email link, a knowledge question, a support request) that resets the factor to attacker control, a step-up prompt that can be skipped or is not enforced server-side...Votes: 0GitHub stars: 5
- Auditing Mobile Backend And Firebase ExposureAudit the backend a mobile app talks to for authorization that lives only in the client, where a mobile-backend service, a hosted datastore, a storage bucket, or a cloud function trusts the app to enforce access and so lets any client read or write another user's data, call a privileged operation, or reach records it should not, because the service rules are permissive, the operation authorizes by client-set values, or the backend assumes only the genuine app calls it. Use when a mobile app u...Votes: 0GitHub stars: 5
- Auditing Mobile Biometric And Local Auth BypassAudit local authentication on a mobile app, where a biometric or device-passcode gate protects sensitive access but can be bypassed because the app trusts the result of the prompt rather than a key released by it, gates only the user interface while the protected data or action remains reachable, does not invalidate the key when enrolled biometrics change, or accepts a callback an attacker can forge on a controlled device. Use when a mobile app gates sensitive data or actions behind a biometr...Votes: 0GitHub stars: 5
- Auditing Mobile Root Jailbreak And Tamper ResistanceAudit whether a mobile app's integrity and environment checks actually enforce a security decision, where the app runs a root or jailbreak check, a repackaging or debugger check, or an emulator check but decides the result on the client, so a controlled device defeats it, or the app relies on such a check to protect a secret or an operation that a genuine attacker on their own device simply bypasses, because the check is advisory rather than a real control and the protected asset is reachable...Votes: 0GitHub stars: 5
- Auditing Mobile Webview Bridge ExposureAudit the trust a mobile app places in web content loaded in an embedded WebView, where a native bridge exposes app capabilities to JavaScript, letting web content that the app did not author, remote pages, loaded third-party frames, or attacker-influenced URLs, call native methods, read app data, or act with the app's privileges, because the bridge is exposed to untrusted origins, the loaded content is not origin-restricted, or the bridge methods do not check the caller. Use when a native ap...Votes: 0GitHub stars: 5
- Auditing Open Redirect And Forced NavigationAudit redirect and navigation flows where an untrusted return, next, or callback URL, a stored value, or a referer drives a server redirect, a client-side location assignment, or a meta refresh to an attacker-chosen destination, enabling phishing, credential capture on a lookalike page, or theft of an OAuth code or token carried on the redirect. Use when a parameter or stored value controls where a user is sent after login, logout, an action, or an authorization step. Covers protocol-relative...Votes: 0GitHub stars: 5
- Auditing Scim Provisioning TrustAudit a SCIM 2.0 provisioning endpoint for trust misplaced in the identity provider that drives it: a provisioning API authenticated by a weak, shared, or long-lived bearer token anyone holding it can use to create users and grant groups, a handler that lets one tenant's client create or modify users in another tenant, a group or role pushed over SCIM that maps to more privilege than the source attribute should grant, a deprovisioning path that fails to disable a departed user so access linge...Votes: 0GitHub stars: 5
- Auditing Service Account Key LifecycleAudit cloud and platform service-account keys for lifecycle weaknesses that turn a non-human credential into standing access: a user-managed key file that never expires and is copied into repos, CI config, or developer laptops, a service account granted far more privilege than its workload needs so the key is a broad credential, a key that is never rotated and has no owner tracking who holds copies, a key that can be created or downloaded by someone who should only use the account, and a disa...Votes: 0GitHub stars: 5
- Auditing Sso Logout And Session RevocationAudit single sign-on logout and session revocation for sessions that outlive the event meant to end them: a logout that clears the local application session but never ends the identity-provider session so re-login is silent, a single-logout flow the application ignores so signing out at the identity provider leaves downstream application sessions alive, an access or refresh token that keeps working after logout or after an admin disables the account, a session that survives a password reset o...Votes: 0GitHub stars: 5
- Auditing Windows Named Pipe And Rpc ExposureAudit local privilege escalation through Windows inter-process interfaces, where a privileged service exposes a named pipe, remote procedure call endpoint, or local COM server that a lower-privileged caller can reach and that performs a privileged action, impersonates the caller unsafely, or trusts caller-supplied input without authorization, letting a standard user drive privileged behavior. Use when a service listens on a named pipe, an RPC interface, or a COM server reachable by non-admini...Votes: 0GitHub stars: 5
- Auditing Windows Token And Privilege AbuseAudit privilege escalation through Windows access token and privilege abuse, where a process holds a sensitive privilege or can obtain a more privileged token, letting a lower-privileged foothold impersonate a privileged caller, load a driver, take ownership, back up protected files, or debug another process to reach a higher context. Use when a service or process runs with a named sensitive privilege enabled or can receive and impersonate tokens from privileged callers. Covers impersonation ...Votes: 0GitHub stars: 5
- Auditing Windows Uac And Integrity BoundariesAudit elevation and integrity boundaries on Windows, where a medium-integrity process reaches a high- integrity context without a genuine consent prompt, through an auto-elevating binary that loads an attacker-influenced input, a writable resource an elevated process consumes, an over-broad elevation policy, or an integrity level that does not gate the operation it should. Use when reviewing how a host distinguishes elevated from non-elevated code and whether a non-administrator can cross tha...Votes: 0GitHub stars: 5
- Hunting Active Directory Acl Abuse PathsHunt privilege escalation through Active Directory object permission abuse, where a low-privileged principal holds a right over a more privileged object, letting it reset a password, add itself to a group, set a delegation or logon script, write a service principal name, or take ownership and rewrite the object's permissions, chaining one granted right into control of a higher-privileged account. Use when directory object permissions may grant a standard user a write over a privileged user, g...Votes: 0GitHub stars: 5
- Hunting Adcs Certificate Template AbuseHunt privilege escalation through Active Directory Certificate Services template and enrollment misconfiguration, where a low-privileged principal can enroll for a certificate that authenticates as a more privileged account, because a template lets the enrollee supply the subject, allows a client authentication use, has weak enrollment permissions, or the certificate authority accepts a requester-set identity. Use when a certificate authority issues templates for domain authentication and a s...Votes: 0GitHub stars: 5
- Hunting Command Argument And Flag InjectionHunt argument and flag injection where untrusted input occupies a slot in a subprocess argument vector, with no shell involved, and the target program parses it as an option rather than data. Covers a value that starts with a dash and becomes a flag, and a value inserted before the program separates options from operands, turning a data argument into one that changes behavior: writing or reading a file, running an embedded command, changing a config or protocol, or reaching a network target. ...Votes: 0GitHub stars: 5
- Hunting Content Type And Parser ConfusionHunt content-type sniffing and parser confusion where untrusted content is served or consumed with an ambiguous or attacker-influenced type, so a browser sniffs a response as HTML, a backend picks a different interpretation than the sender intended, or two parsers on one path disagree. Use when user content is echoed with a missing, wrong, or user-controlled content type, when uploads are typed by extension or by the client, or when a request body can be parsed more than one way. Covers respo...Votes: 0GitHub stars: 5
- Hunting Crlf And Response SplittingHunt CRLF injection where untrusted input carrying a carriage return and line feed reaches a response header, a log line, or an outbound email header that does not strip or reject those characters, letting the attacker inject headers, split the message, forge log entries, or add email headers. Use when input flows into a Set-Cookie, Location, or custom response header, into a log written from request data, or into mail headers built from user input. Covers full response splitting into injecte...Votes: 0GitHub stars: 5
- Hunting Formula Injection In ExportsHunt formula injection, also called CSV injection, where an untrusted field stored by the application is later written into an exported CSV, TSV, or spreadsheet and a spreadsheet program evaluates it as a formula when a victim opens the file. A cell whose first character is an equals, plus, minus, or at sign, or a tab or carriage-return prefix, is treated as a formula, so a stored value can call a data connection or hyperlink to exfiltrate other cells, trigger a legacy dynamic-data command th...Votes: 0GitHub stars: 5
- Hunting Host Header And Url Parsing TrustHunt trust placed in the Host or a forwarded host header and in inconsistently parsed URLs, where the app builds absolute links, keys a cache, routes a request, or matches an allowlist from a header or a parsed URL an attacker can influence or that two components parse differently. Use when a service derives its own external URL from the request, when a cache or router keys on the host, or when a security decision parses a URL. Covers password-reset and verification-link poisoning, cache pois...Votes: 0GitHub stars: 5
- Hunting Http Parameter PollutionHunt HTTP parameter pollution, where the same parameter name appears more than once, or a parameter is shaped as an array, and two components in the request path disagree on how to resolve it. A validator, a gateway, or a filter reads one occurrence while the backend sink reads another, so a value that passes a check is not the value that is used, and a control is bypassed, an authorization decision is confused, or a payload is smuggled past a filter. First-versus-last-wins differentials, arr...Votes: 0GitHub stars: 5
- Hunting Hybrid App Bundle And Config ExposureHunt secrets and abusable configuration shipped inside a mobile app bundle, where the installable package carries hardcoded API keys, backend credentials, signing or encryption material, private endpoints, or feature and debug flags in its code, resources, web assets, or configuration files, so anyone who unpacks the distributed app recovers them, because the bundle is treated as private when a distributed binary is fully readable. Use when reviewing what a shipped mobile app package contains...Votes: 0GitHub stars: 5
- Hunting Ios Keychain And Data Protection GapsHunt at-rest exposure of secrets on iOS, where a credential, token, or sensitive value is stored with a keychain accessibility class or a data-protection class weaker than it needs, so it is readable when the device is locked, survives into a device backup, or is reachable by another app or after theft, because the item is marked always-accessible, is not restricted to this device, or the file protection lets it be read outside an unlocked session. Use when reviewing how an app stores secrets...Votes: 0GitHub stars: 5
- Hunting Kerberos And Ad Delegation AbuseHunt for Active Directory Kerberos delegation configurations that let one identity act as another: a service account with unconstrained delegation that can impersonate any user who authenticates to it and reuse their ticket anywhere, constrained delegation configured so a service can request tickets for higher-privileged targets, resource-based delegation an attacker can set on an object they control to relay into it, a service account with a weak password exposed to Kerberoasting through its...Votes: 0GitHub stars: 5
- Hunting Mobile Tapjacking And Overlay AbuseHunt mobile interface redressing, where another app draws over or intercepts a sensitive screen so the user acts on the attacker's terms without knowing it, approving a permission, confirming a transaction, or entering a secret while an overlay hides or fakes what they are really touching, because the sensitive screen does not detect that it is obscured, does not filter touches passed through an overlay, or does not bind the confirmation to what the user actually saw. Use when a mobile app pr...Votes: 0GitHub stars: 5
- Hunting Mobile Tls Pinning And Trust GapsHunt transport trust gaps in a mobile app, where the app accepts a network position it should reject, because it trusts user-added certificate authorities, allows cleartext or mixed connections, disables or misapplies certificate validation, or pins only some connections so an unpinned or fallback path lets a network attacker read or alter traffic the app treats as secure. Use when reviewing how a mobile app establishes and validates its network connections and whether every sensitive connect...Votes: 0GitHub stars: 5
- Hunting Ntlm Coercion And RelayHunt authentication coercion and relay on a Windows network, where an attacker induces a privileged machine or account to authenticate to a host it controls and forwards that authentication to a service that does not bind or verify the channel, authenticating as the coerced identity because signing is not enforced and channel binding is absent. Use when services accept network authentication without mandatory signing or channel binding and a privileged host can be induced to authenticate outb...Votes: 0GitHub stars: 5
- Hunting Os Command InjectionHunt OS command injection where untrusted input reaches a process-spawning API through a shell that interprets metacharacters. Covers a command string passed to a system or shell-exec call, a spawn that requests a shell, and indirect shells reached through wildcards, subshells, environment values, or an attacker-influenced PATH or IFS. The distinguishing fact is the shell: a direct exec with a fixed program and an argument vector does not interpret metacharacters and is not this bug, while an...Votes: 0GitHub stars: 5
- Hunting Path Traversal And File AccessHunt path traversal and unsafe file access where untrusted input builds a filesystem path and the resolved path escapes the intended base directory, so the process reads or writes files it should not. Covers download and upload names, template and include paths, static-file routes, and archive members driven to dot-dot or absolute or drive-letter targets, encoded and double-encoded separators, null-byte truncation on legacy stacks, symlink following, and the difference between checking the ra...Votes: 0GitHub stars: 5
- Hunting Reflected And Stored XssHunt reflected and stored cross-site scripting in server-rendered responses, where untrusted request or stored data is placed into an HTML response in a context whose encoding is missing or wrong, so the value becomes markup or script that runs in the victim's session. Covers the output context that decides the correct encoding, HTML body versus quoted or unquoted attribute versus inline script versus URL versus CSS, a template raw or safe marker that disables autoescaping, JSON embedded in a...Votes: 0GitHub stars: 5
- Hunting Server Side And Edge Side IncludesHunt server-side include and edge-side include injection, where untrusted input is reflected into a document that a processor later interprets for include and exec directives. When an origin server has server-side includes enabled, a reflected directive can read a server file or run a command. When a cache, content-delivery network, or proxy in front of the origin parses edge-side include tags, a reflected tag can fetch an internal URL for server-side request forgery, poison a shared cache, o...Votes: 0GitHub stars: 5
- Hunting Server Side Rendering And Svg Image AbuseHunt abuse of server-side renderers of user-supplied markup, such as headless-browser PDF or screenshot generation, SVG rasterization, thumbnailers, and chart or document renderers, where the renderer fetches remote or local resources, follows redirects, executes embedded script, or reads local files while producing output. Use when untrusted HTML, SVG, or a URL is handed to a rendering component server-side. Covers server-side request forgery including to cloud metadata, local file disclosur...Votes: 0GitHub stars: 5
- Hunting Server Side Template InjectionHunt server-side template injection where untrusted input becomes part of a template that the engine compiles and evaluates, rather than data passed into a fixed precompiled template. Covers input concatenated into a template string, a user-chosen template name or path, and admin or content features that render user-authored templates, across engines like Jinja, Twig, Freemarker, Velocity, ERB, and Handlebars. The impact runs from expression evaluation and data disclosure up to remote code ex...Votes: 0GitHub stars: 5
- Hunting Tenant Onboarding And Discovery AbuseHunt for multi-tenant SaaS onboarding and organization-discovery flows that let an attacker join, claim, or enumerate a tenant they should not: a self-service signup that auto-joins a new user to an existing organization by email domain so anyone with a matching address lands inside it, a domain-claim step that can be satisfied without proving ownership so an attacker claims a domain and its users, an invitation whose token is guessable, reusable, or not bound to the invited address, a tenant...Votes: 0GitHub stars: 5
- Hunting Unicode Normalization And Canonicalization BypassHunt security bypasses where a check passes on one representation of untrusted input and a normalization, decoding, or case-folding step then turns it into a different, dangerous form at the sink. Use when an authorization, filter, allowlist, path-containment, or identifier comparison runs on input that is later normalized, percent- or entity-decoded, or case-folded before it reaches the operation it guards. Covers Unicode normalization forms, overlong and double encoding, case-fold and local...Votes: 0GitHub stars: 5
- Hunting Windows Credential Material ExposureHunt exposure of Windows credential material, where secrets that authenticate a user or machine, cached logon verifiers, stored service and task passwords, protected-store secrets, saved connection credentials, and credentials left in memory of a privileged process, are readable by a principal that should not reach them because of a weak permission, an over-privileged token, or storage that does not bind the secret to the intended account. Use when reviewing where Windows keeps authentication...Votes: 0GitHub stars: 5
- Hunting Windows Dll Hijacking And Search OrderHunt code execution through Windows library search order, where a privileged process loads a library by name and resolves it from a location a lower-privileged user can write, because the library is absent from its expected directory, the application directory or a path entry is writable, or the load uses an unsafe search that reaches the current or a user-controlled directory. Use when reviewing how a privileged executable or service resolves its dynamic libraries and whether any resolution ...Votes: 0GitHub stars: 5
- Hunting Windows Service Privilege EscalationHunt local privilege escalation through Windows service misconfiguration, where a low-privileged user can influence what a service runs as a higher-privileged account, through a weak service object permission, a writable service binary or its directory, an unquoted service path with a writable intervening directory, or a weak permission on the service's registry configuration. Use when reviewing installed services and their binaries, paths, and permissions on a Windows host for a standard-use...Votes: 0GitHub stars: 5
- Hunting Xpath And Xml Query InjectionHunt XPath and XQuery injection where untrusted input is concatenated into a query expression that is then evaluated against an XML document or an XML database, so the input changes the structure of the query rather than supplying a value. A predicate closed early and rewritten to always be true bypasses an authentication or authorization lookup, and a rewritten path or an injected union walks the document to read nodes the caller was never meant to reach, including blind boolean and out-of-b...Votes: 0GitHub stars: 5
- Hunting Xxe And Xml Parser TrustHunt XML external entity injection and unsafe XML parser features where untrusted XML is parsed with document type definitions, external general or parameter entities, or XInclude enabled. Covers in-band file disclosure and server-side request forgery through external entities, blind out-of-band exfiltration through parameter entities, and denial of service through entity expansion. The XML often hides inside other formats: office documents, SVG images, SOAP calls, and identity assertions all...Votes: 0GitHub stars: 5
- Testing Postmessage And Web Message TrustTest cross-document messaging trust, where a browser message handler acts on data whose origin or content an attacker can influence by opening or framing the window, or where code sends sensitive data to another window with a wildcard target. Use when reviewing client code that registers a message event listener and routes the data into the DOM, an evaluation, navigation, or storage, or that posts secrets across windows. Covers a missing, wildcard, or substring origin check, a missing source-...Votes: 0GitHub stars: 5
- Testing Web Cache DeceptionTest web cache deception, where an attacker crafts a static-looking URL, using an added extension, a path delimiter, or a query variant, that maps to the same authenticated dynamic response while a shared cache, keying on the apparent extension or path, stores that private response and serves it to the attacker. Use when a shared cache sits in front of authenticated content and its rule for what is cacheable can disagree with what the origin treats as the same resource. Covers extension-based...Votes: 0GitHub stars: 5