All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,761
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 9,289–9,312 of 29,761 skills
- Hunt CloudCloud attack hunting for AWS / Azure / GCP - credential discovery, metadata SSRF, IAM privesc, service enumeration, persistence. Scope + billing aware. Wiki-first, FIND schema output.Votes: 0GitHub stars: 323
- Hunt CicdCI/CD pipeline attack hunting (GitHub Actions focus) - pwn requests (pull_request_target), script injection, self-hosted runner takeover, cache poisoning, OIDC-to-cloud token theft, poisoned pipeline execution. Wiki-first, FIND schema output.Votes: 0GitHub stars: 323
- Hunt AuthAuth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output.Votes: 0GitHub stars: 323
- Hunt ApiAPI attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output.Votes: 0GitHub stars: 323
- Hunt AdActive Directory attack hunting - enumeration to domain dominance. Spray-safe (lockout gate), AS-REP/Kerberoast, ACL + ADCS (ESC1-16), delegation, DCSync, lateral movement. Wiki-first, FIND schema output.Votes: 0GitHub stars: 323
- DisclosureDrive responsible disclosure of a proven finding to a CVE. Package the report, find the vendor contact, report privately, coordinate a timeline, request the CVE (vendor CNA / GitHub / MITRE), and publish an advisory. Closes the research loop. Triggers - "disclose", "request a cve", "report this to the vendor".Votes: 0GitHub stars: 323
- Web Xss DomYou are helping a penetration tester exploit DOM-based cross-site scripting. TheVotes: 0GitHub stars: 2
- Web Web DiscoveryYou are helping a penetration tester discover vulnerabilities in a webVotes: 0GitHub stars: 2
- Web Password Reset PoisoningYou are helping a penetration tester exploit password reset vulnerabilities.Votes: 0GitHub stars: 2
- Web Oauth AttacksYou are helping a penetration tester exploit OAuth 2.0 and OpenID ConnectVotes: 0GitHub stars: 2
- Web Ldap InjectionYou are helping a penetration tester exploit LDAP injection vulnerabilities.Votes: 0GitHub stars: 2
- Web Jwt AttacksYou are helping a penetration tester exploit JWT (JSON Web Token)Votes: 0GitHub stars: 2
- Web IdorYou are helping a penetration tester exploit Insecure Direct Object ReferenceVotes: 0GitHub stars: 2
- Web Deserialization JavaYou are helping a penetration tester exploit Java deserializationVotes: 0GitHub stars: 2
- Web Deserialization DotnetYou are helping a penetration tester exploit .NET deserializationVotes: 0GitHub stars: 2
- Web Cors MisconfigurationYou are helping a penetration tester exploit Cross-Origin Resource SharingVotes: 0GitHub stars: 2
- Web Browser ExploitationYou are helping a penetration tester exploit browser-based attack surfaces. ThisVotes: 0GitHub stars: 2
- Web Ajp GhostcatYou are helping a penetration tester exploit Apache JServ Protocol (AJP)Votes: 0GitHub stars: 2
- Offensive XxeXML External Entity injection testing checklist: classic XXE, blind XXE (out-of-band), XXE via file upload (SVG/docx), XXE in SOAP/REST, error-based XXE, XInclude attacks, and XXE filter bypass. Use for web app XXE testing and bug bounty.Votes: 0GitHub stars: 2
- Offensive Request SmugglingHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.Votes: 0GitHub stars: 2
- Offensive OauthOAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.Votes: 0GitHub stars: 2
- Offensive IdorIDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.Votes: 0GitHub stars: 2
- Offensive GraphqlOffensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subsc...Votes: 0GitHub stars: 2
- Offensive Api AbuseAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion throu...Votes: 0GitHub stars: 2