All authors
Claude Skills by NoorQureshi
github.com/NoorQureshi206 skills0 installs21 views
- Reverse Eng Binary TriageTriage a native binary you can run or read — find the vulnerable logic, the dangerous sinks, and the input path — with static + dynamic analysis. Load when handed an ELF/PE/Mach-O, a thick client, a standalone or obfuscated binary, or a service whose source you don't have. Signals: a compiled executable in scope, "reverse this binary", a crash/segfault to understand, custom protocol, strings that hint at auth/secrets, a setuid binary during privesc.Votes: 0GitHub stars: 20
- Reverse Eng DeobfuscationPeel obfuscation off code until it's readable or callable — packed native binaries, minified/ obfuscated JavaScript, WebAssembly, and JS-VM-protected (JSVMP) bundles. Load when analysis is blocked by protection layers. Signals: high-entropy sections, a tiny import table, UPX headers, string-array/control-flow-flattened JS, `_0x` variable names, a .wasm module, an interpreter loop over a bytecode array, anti-debugger `debugger;` traps.Votes: 0GitHub stars: 20
- Reverse Eng FirmwareExtract and analyze device firmware to find hardcoded secrets, backdoors, vulnerable services, and the real version behind an appliance. Load when you have a firmware image or can pull one. Signals: a .bin/.img firmware download, a router/IoT/appliance in scope, an OTA update file, a flash dump, "analyze this firmware", SquashFS/JFFS2/CramFS, U-Boot headers, hunting the code behind a CVE on FortiGate/Ivanti/etc.Votes: 0GitHub stars: 20
- Social Eng MethodologyPlan and run an AUTHORIZED social-engineering assessment safely — the load-first guardrails for any human-factor test. Load before any phishing, vishing, pretext, or physical work. Signals: "social engineering", "phishing assessment", "test our employees", "security awareness", a human-factor objective in a pentest SoW. Establishes authorization, safety, tracking, and the awareness-focused report.Votes: 0GitHub stars: 20
- Social Eng PhishingRun an authorized phishing / spear-phishing assessment that measures human-factor risk — pretext, delivery, landing page, and tracking — without harming staff or hoarding real data. Load after social-eng-methodology when the objective is email-based (click, credential submission, or report rate). Signals: "phishing test", "simulated phishing", "test click rate", "credential harvesting assessment", awareness-campaign objective.Votes: 0GitHub stars: 20
- Social Eng PhysicalRun an authorized physical social-engineering assessment — tailgating, pretext entry, badge/RFID cloning checks, and media-drop tests — to measure physical and human access controls safely. Load after social-eng-methodology when the objective is on-site. Signals: "physical pentest", "test our building access", "tailgating", "badge cloning", "USB drop", "can we get into the office/data center". Requires a carried authorization letter.Votes: 0GitHub stars: 20
- Social Eng Vishing PretextRun authorized voice-phishing (vishing) and pretext-based scenarios that test whether staff and help desks follow verification procedures — safely and by consent. Load after social-eng-methodology when the objective is phone/live-interaction based (help-desk password reset, MFA-reset abuse, pretext callback). Signals: "vishing", "call the help desk", "pretext", "test our verification process", "MFA reset social engineering".Votes: 0GitHub stars: 20
- Tradecraft Attack Path MappingModel the target as an attack graph — nodes (assets, identities, trust) and edges (a technique that gets you from one to the next) — and find the shortest path to the objective. Load when many findings need to be assembled into a route, on "how do these bugs connect", AD/cloud lateral- movement planning, or to explain how a foothold reaches crown jewels.Votes: 0GitHub stars: 20
- Tradecraft Attack ScenariosTurn a goal + a scope into a concrete, ordered attack scenario across multiple skills — not one technique in isolation. Load at the START of an engagement, on "where do I even begin", when a target has many surfaces, or to plan an objective-driven path (e.g. "reach domain admin", "prove data exfil"). This is how an agent decides what to try, in what order, and why.Votes: 0GitHub stars: 20
- Tradecraft Bugbounty PlatformsUnderstand how the major bug-bounty platforms differ — scope rules, disclosure, triage, and reputation — so you play each correctly. Load when working a program on HackerOne, Bugcrowd, Intigriti, YesWeHack, or Immunefi, on "platform rules", "safe harbor", "VDP vs paid", or before submitting. Signals: a program URL on one of these platforms, a policy/scope page.Votes: 0GitHub stars: 20
- Tradecraft Complex EngagementsStructure and discipline for complex, multi-stage targets — where the path is a chain of several bugs across multiple hosts, needs source review / custom exploit work, and spans sessions. Load when a foothold needs chaining, work spans multiple hosts, you're deep in dead-ends, or "stuck", "chain", "multi-host", "hard target".Votes: 0GitHub stars: 20
- Tradecraft Duplicate AvoidanceAvoid burning time on bugs that will be closed as duplicates. Load during bug-bounty work when deciding what to report or where to dig, on "will this be a dup", "is this already known", maximizing unique findings. Signals: a mature/popular program, a common vuln on an obvious asset, a recently expanded scope.Votes: 0GitHub stars: 20
- Tradecraft Pivot DecisionsDecide what to do next after a result — the branching logic that turns a single outcome into the next lead. Load whenever a step just finished (success, partial, or dead end) and it's unclear where to go: "what now", "I got a shell/creds/a hash", "this didn't work", triaging which of several leads to pursue. This is the decision engine between techniques.Votes: 0GitHub stars: 20
- Tradecraft Scope RoeEstablish and enforce the authorization envelope before any testing — the scope rule that governs everything. Load FIRST on every engagement, on "start", a new target, a program handle, or any ambiguity about what is allowed. Signals: a domain/IP to test, a bug-bounty program handle, a pentest statement of work, a scope list.Votes: 0GitHub stars: 20
- Tradecraft Target SelectionChoose where to spend effort for the best return — which program, which asset, which surface. Load at the start of bug-bounty work or when a scope is broad and time is limited, on "which program", "where should I hunt", "prioritize these targets". Signals: a big scope list, many in-scope domains, a new program, limited time.Votes: 0GitHub stars: 20
- Web Account TakeoverSystematic account-takeover hunting — password reset, email change, session, and linking flaws that seize another user's account. Load on "ATO", password-reset/forgot flows, email-change, OTP/2FA, "login as", session handling. Signals: reset tokens, email-change without re-auth, OTP, magic links.Votes: 0GitHub stars: 20
- Web ArsenalOne line: web enumeration + exploitation tool arsenal for authorized engagements. Trigger signals: port 80/443/8080/8443 open, "web", a URL to a lab target, an HTTP service surfaced by recon. Authorized, in-scope targets only.Votes: 0GitHub stars: 20
- Web Auth JwtAttack JWT/session authentication. Load when auth uses a JWT (three base64url parts, header.payload.signature), Authorization: Bearer, or you see alg/kid/jku fields. Signals: eyJ... tokens, "alg":"none"/"HS256"/"RS256", kid header, JWKS endpoints, role/admin claims.Votes: 0GitHub stars: 20
- Web Auth Session HandlingLegitimately acquire and KEEP an authenticated session (through MFA/OTP) so you can test the post-auth attack surface, and hand that session to your tools without leaking secrets. Load when the high-value classes (IDOR/BOLA, mass assignment, injection on real data APIs) are blocked behind login/SMS-OTP/TOTP, when tokens keep expiring mid-test, or when Burp/Playwright keep logging you out. Distinct from attacking auth — this one authenticates and reuses the session.Votes: 0GitHub stars: 20
- Web Business LogicFind business-logic flaws — abusing intended functionality in unintended ways. Load on workflows with money/quantity/state/limits: checkout, coupons, refunds, transfers, quotas, multi-step flows, role/tenant boundaries. Signals: price/qty params, discount codes, step skipping, negative/overflow values.Votes: 0GitHub stars: 20
- Web Cache DeceptionTrick a CDN/cache into storing a victim's authenticated response at a public URL, then read it. Load on "web cache deception", when a CDN/cache sits in front of an app that serves per-user content, or to test whether private pages can be cached. Signals: `X-Cache`/`CF-Cache-Status` headers, caching by file extension, static-looking suffixes on dynamic endpoints.Votes: 0GitHub stars: 20
- Web Cache PoisoningWeb cache poisoning & deception — get a shared cache to serve attacker content to other users, or trick it into caching victims' private pages. Load behind a CDN/cache (Cloudflare, Varnish, Fastly, Akamai), on unkeyed headers, `X-Forwarded-Host`, cache headers, or static-looking URLs. Signals: `Age`/`X-Cache` headers, CDN, reflected headers.Votes: 0GitHub stars: 20
- Web ClickjackingClickjacking / UI redress — frame a target so a victim's clicks hit hidden actions. Load when a page allows framing (no X-Frame-Options / frame-ancestors), on state-changing one-click actions, or "clickjacking". Signals: missing framebusting headers, sensitive buttons, OAuth consent, account settings.Votes: 0GitHub stars: 20
- Web Client Side Signing BypassReverse client-side request signing / obfuscated JS so you can replay and fuzz a protected API outside the browser. Load when requests carry a computed guard you must reproduce: an X-Signature / X-Sign / sign / hmac / _s / token header or body field, a nonce+timestamp, a "signature invalid" 401, encrypted request bodies, or minified/webpack/WASM/JSVMP signer code.Votes: 0GitHub stars: 20
- Web Command InjectionTurn user input that reaches a shell into arbitrary OS command execution. Load when a parameter feeds a system call — ping/nslookup/host tools, file conversion (ImageMagick, ffmpeg), archive/ export, PDF/thumbnail generation, filename handling, or any "network tools" feature. Signals: output that looks like command output, a value echoed into a system utility, blind time/OOB behaviour.Votes: 0GitHub stars: 20
- Web CorsExploit CORS misconfiguration to read cross-origin responses (data theft). Load when an API reflects Origin into Access-Control-Allow-Origin, allows credentials cross-origin, or trusts null/subdomains. Signals: ACAO reflects your Origin, ACAC: true, `Origin`-dependent responses.Votes: 0GitHub stars: 20
- Web Csp BypassGet script to run despite a Content-Security-Policy — the step after finding an injection that CSP is blocking. Load when you have HTML/JS injection but the payload won't execute, on "CSP is blocking my XSS", or when auditing a CSP for weakness. Signals: a Content-Security-Policy header, a blocked-script console error, a reflected injection with no popup.Votes: 0GitHub stars: 20
- Web CsrfCross-Site Request Forgery — force a victim's browser to perform state-changing actions. Load on state-changing requests (POST/PUT/DELETE) that rely only on cookies, missing/weak CSRF tokens, `SameSite=None`, or forms/JSON without anti-CSRF. Signals: cookie-only auth, no token, token not validated.Votes: 0GitHub stars: 20
- Web Cypher InjectionInject into Neo4j Cypher queries to bypass auth, exfiltrate graph data, and reach SSRF/RCE. Load when user input reaches a Cypher query (Neo4j-backed app, GraphQL/REST over a graph DB) — a login, search, or filter that builds `MATCH (n {prop:'<input>'})`. Signals: Neo4j/Bolt (7687), `MATCH`/ `RETURN` in errors, `neo4j` cookies/stack traces, apoc procedures, a graph-backed search field.Votes: 0GitHub stars: 20
- Web Dependency ConfusionDependency confusion / substitution — publish a malicious public package matching an internal name so build systems pull yours. Load on leaked internal package names (npm/PyPI/RubyGems/Maven), package.json/requirements with unknown deps, or private-registry setups. Signals: @scope/internal packages, non-public dep names in manifests, .npmrc/registry config leaks.Votes: 0GitHub stars: 20
- Web DeserializationInsecure deserialization → RCE via gadget chains. Load when the app deserializes attacker data: Java (rO0/AC ED base64), PHP `unserialize` (O:), Python pickle, .NET BinaryFormatter/ViewState, Ruby Marshal/YAML. Signals: serialized blobs in cookies/params, `__VIEWSTATE`, `rO0AB`, `O:8:`.Votes: 0GitHub stars: 20
- Web Dom ClobberingOverwrite a page's JavaScript variables using only injected HTML — no script needed. Load when a sanitizer allows tags/attributes but strips script, and the app reads config/state from the DOM or globals. Signals: HTML injection behind DOMPurify/an allowlist, client code using `window.X`, `document.getElementById(...)`, or `config.*` that could come from named elements.Votes: 0GitHub stars: 20
- Web File UploadTurn a file upload into RCE or stored XSS/SSRF. Load on any upload: avatars, attachments, import CSV/XML, profile images, document processors, "upload your resume". Signals: multipart/form-data, filename in response, an uploads/ path, image thumbnailing, PDF/office parsing.Votes: 0GitHub stars: 20
- Web Host HeaderHost header injection — abuse a trusted Host/X-Forwarded-Host to poison password-reset links, routing, and caches. Load when the app builds absolute URLs from the request host, on password-reset flows, or behind a proxy/CDN. Signals: reset emails with links, X-Forwarded-Host reflected, virtual hosting, cache in front.Votes: 0GitHub stars: 20
- Web Http Parameter PollutionSend the same parameter more than once so the WAF/validator and the backend disagree on which value wins — bypassing filters, access control, or business logic. Load on "HPP", when a value is validated at one layer but used at another, or when a WAF blocks a payload you need to slip past. Signals: proxies/gateways in front of the app, duplicated params reflected inconsistently.Votes: 0GitHub stars: 20
- Web IdorInsecure Direct Object Reference / broken access control on web objects. Load when a request references an object by id you can change: /account/1234, ?invoice=987, UUIDs in URLs/bodies, "download", "view", "edit" endpoints, numeric or guessable identifiers, or multi-tenant apps. Signals: sequential IDs, object refs in JSON, role/owner not re-checked.Votes: 0GitHub stars: 20
- Web Jdbc AttacksTurn an attacker-controllable database connection string / JDBC URL into RCE via the driver itself. Load when an app lets you set a DB host/URL/driver: a "test connection" form, a data-source config, an ETL/reporting/integration tool, or a processor that takes a JDBC URL. Signals: a jdbc: URL field, H2/MySQL/Postgres connection settings, Apache NiFi/Mirth/Metabase/DBeaver-style data-source config, "connection string", driver properties you can edit.Votes: 0GitHub stars: 20
- Web Lfi Path TraversalLocal File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../` filtered, `.php?page=`.Votes: 0GitHub stars: 20
- Web Mfa BypassDefeat a second authentication factor — OTP/TOTP, SMS, push, or backup codes. Load when login has a 2FA/MFA step and you want to reach the account without the factor, on "2FA bypass", "OTP brute", "MFA", or during account-takeover work. Signals: an OTP/verification screen after password, a "verify your device" step, `/verify`, `/2fa`, `otp`/`code` parameters.Votes: 0GitHub stars: 20
- Web OauthAttack OAuth 2.0 / OIDC / SSO flows for account takeover. Load on "Login with Google/GitHub", /authorize, /callback, redirect_uri, state, code/token params, SAML/OIDC SSO. Signals: OAuth endpoints, redirect_uri handling, missing state, implicit flow, pre-account-linking.Votes: 0GitHub stars: 20
- Web Open Graph SsrfSSRF through link-preview / URL-unfurl / oEmbed features. Load when the app generates a preview card for a user-supplied URL: chat/forum/comment link unfurling, "add a link" in posts or profiles, oEmbed endpoints, rich-text editors that auto-embed, bookmark/save-for-later tools, or any UI that shows an Open Graph title/image/description for a pasted link. Signals: params like url=, link=, embed=, preview=; a "fetching preview" spinner; response JSON with og:title / og:image fields; User-Agent...Votes: 0GitHub stars: 20
- Web Open RedirectOpen redirect — abuse a redirect param to send users to attacker sites, and chain it (OAuth token theft, SSRF filter bypass, phishing). Load on params like redirect=, next=, url=, return=, callback=, dest=, or a 30x Location built from input. Signals: `?returnUrl=`, login redirects, OAuth `redirect_uri`.Votes: 0GitHub stars: 20
- Web PostmessageExploit insecure cross-window messaging (`window.postMessage`) — handlers that trust `event.data` without checking `event.origin`, leading to XSS, token theft, or state change. Load when the app uses iframes/popups/SSO widgets, on "postMessage", or when JS registers a `message` listener. Signals: `addEventListener("message", ...)`, embedded third-party frames, SSO/login popups.Votes: 0GitHub stars: 20
- Web Prototype PollutionJavaScript prototype pollution (client & server) → XSS, auth bypass, RCE via gadgets. Load on Node.js/JS apps that merge user objects: query/JSON parsing, `Object.assign`/deep-merge, lodash/jQuery.extend, config merges. Signals: __proto__, constructor.prototype in params, Node backend, client-side sinks.Votes: 0GitHub stars: 20
- Web Python Sandbox EscapeEscape a Python sandbox / eval jail to reach code execution — defeat keyword blocklists and restricted eval/exec by reaching objects through the class hierarchy. Load when user input hits eval/exec/a "safe" expression evaluator, a Python REPL/calculator feature, a template that runs Python, or a filtered code box. Signals: "eval", "exec", `__import__` blocked, banned words (import/os/system), a Python jail, PyYAML/pickle input, a formula/expression field.Votes: 0GitHub stars: 20
- Web Race ConditionsExploit race conditions / TOCTOU — fire concurrent requests to break single-use limits. Load on "limit-once" actions: coupon/gift-card redemption, withdrawals, votes, invites, MFA/OTP attempts, balance changes. Signals: check-then-act on shared state, per-user quotas, "already used".Votes: 0GitHub stars: 20
- Web Rate Limit BypassBypass rate limits and anti-automation to enable brute force, OTP guessing, coupon abuse, and enumeration. Load when an endpoint is throttled (429/"too many attempts"), on login/OTP/reset, or "rate limit". Signals: 429 responses, lockout messages, per-account throttling, OTP/2FA.Votes: 0GitHub stars: 20
- Web Request SmugglingHTTP request smuggling (CL.TE/TE.CL/TE.TE/CL.0) — desync front-end and back-end to poison other users' requests. Load behind a proxy/CDN/load-balancer, on "smuggling/desync", or when Content-Length vs Transfer-Encoding handling differs. Signals: front-end + back-end chain, timing anomalies, HTTP/1.1 keep-alive.Votes: 0GitHub stars: 20
- Web SamlAttack SAML SSO — signature exclusion/wrapping (XSW), unsigned assertions, and comment/XXE tricks to forge authentication. Load on SAML SSO (SAMLResponse, ACS URL, IdP/SP), enterprise login, or "SAML". Signals: SAMLResponse base64 in POST, /saml/acs, <saml:Assertion>, Shibboleth/ADFS/Okta SSO.Votes: 0GitHub stars: 20
- Web SqliDetect and exploit SQL injection (error-based, UNION, boolean/time blind, stacked). Load when a param feeds a query, you see DB errors, numeric/string params change result sets, login forms, search, sort/order-by, or ORM raw queries. Signals: "id=", 500 on a quote, "You have an error in your SQL syntax", MySQL/Postgres/MSSQL/Oracle banners.Votes: 0GitHub stars: 20