All authors
Claude Skills by ShulkwiSEC
github.com/ShulkwiSEC331 skills4 installs834 views
- Idor Vulnerability HuntingDetect and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. Use this skill when testing for unauthorized access to resources by manipulating object identifiers like user IDs, order numbers, file references, or API endpoints. Covers parameter tampering, UUID prediction, hash manipulation, and chained IDOR attacks for maximum impact in bug bounty programs.Votes: 0GitHub stars: 22
- Indirect Prompt InjectionExecute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing legitimate user requests.Votes: 0GitHub stars: 22
- Info DisclosureComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Injection CheckingEntry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.Votes: 0GitHub stars: 22
- Insecure DeserializationComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Insecure Direct Object Reference IdorIdentify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.Votes: 0GitHub stars: 22
- Insecure File UploadUse when testing file upload endpoints for unrestricted file upload, MIME type bypass, magic byte spoofing, polyglot files, SVG XSS, XXE via Office documents, ZIP slip, and path traversal in filenames. Trigger on: multipart/form-data endpoints, avatar/document upload flows, import-from-file features, profile image, CSV/Excel import, DOCX/XLSX parsing, image resizing pipelines, archive extraction, and any endpoint that stores or serves user-supplied files. Detects extension bypass (shell.php.j...Votes: 0GitHub stars: 22
- Insecure Source Code ManagementSource control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.Votes: 0GitHub stars: 22
- Ios Application Hooking FridaExecute dynamic instrumentation utilizing Frida to inject custom JavaScript into running iOS applications (IPAs) on jailbroken devices. Hook native functions, bypass SSL Pinning, bypass Jailbreak Detection, and manipulate in-memory data at runtime.Votes: 0GitHub stars: 22
- Ios Pentesting TricksiOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.Votes: 0GitHub stars: 22
- Ipv6 Dns Takeover MitmExecute an IPv6 DNS Spoofing attack using `mitm6` on an IPv4-only corporate network. Exploit default Windows behavior (preferring IPv6 DHCP/DNS) to intercept NTLMv2 hashes, force WPAD rogue proxy settings, and relay credentials to Active Directory services.Votes: 0GitHub stars: 22
- Ipv6 Dns Takeover Mitm6Exploit modern Windows environments that prefer IPv6 by using mitm6 to intercept and spoof DHCPv6 and DNS traffic. This skill covers how to poison DNS resolution for the local network, forcing NTLM authentication to a rogue server for credential capture or relay.Votes: 0GitHub stars: 22
- Java Insecure Deserialization YsoserialExploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.Votes: 0GitHub stars: 22
- Javascript Prototype PollutionIdentify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.Votes: 0GitHub stars: 22
- Jndi InjectionJNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().Votes: 0GitHub stars: 22
- Jwt Algorithm ConfusionIdentify and exploit Algorithm Confusion vulnerabilities in JSON Web Tokens (JWT). This skill details how to bypass signature verification by changing the signing algorithm from asymmetric (RS256) to symmetric (HS256) and using the public key as the symmetric secret.Votes: 0GitHub stars: 22
- Jwt Forgery Algorithm ConfusionExploit implementations of JSON Web Tokens (JWT) through algorithmic confusion (e.g., RS256 to HS256), "none" algorithm attacks, and signature stripping. Use this skill to forge administration tokens and achieve unauthenticated Account Takeover (ATO) on REST APIs and modern web applications.Votes: 0GitHub stars: 22
- Jwt LabsComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Jwt MisconfigUse when testing JWT-based authentication for algorithm confusion, alg:none bypass, weak HMAC secrets, missing expiration, kid parameter injection, and token storage in localStorage. Trigger on: Authorization: Bearer tokens, JWTs in cookies, any base64url encoded header.payload.signature pattern, OAuth2 access tokens, API authentication tokens, SSO tokens, JWKS endpoints. Detects RS256→HS256 confusion, public key as HMAC secret, unverified kid values used in file reads or SQL queries, and JWT...Votes: 0GitHub stars: 22
- Jwt Null SignatureExploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the `alg` header set to `none`, allowing attackers to forge tokens without a valid signature.Votes: 0GitHub stars: 22
- Jwt Oauth Token AttacksJWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.Votes: 0GitHub stars: 22
- Kaido Proxy IntegrationIntegrate Kaido (Caido) proxy with Claude Code CLI for automated HTTP interception, request replay, and vulnerability scanning. Based on Critical Thinking Ep. 166.Votes: 0GitHub stars: 22
- Kerberoasting Active DirectoryExecute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.Votes: 0GitHub stars: 22
- Kerberoasting AttackExploit Active Directory environments using Kerberoasting. This skill details how to identify Service Principal Names (SPNs) associated with user accounts, request their TGS tickets, and crack the RC4 encrypted component offline to recover service account passwords.Votes: 0GitHub stars: 22
- Kernel ExploitationLinux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.Votes: 0GitHub stars: 22
- Kubernetes PentestingKubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.Votes: 0GitHub stars: 22
- Kubernetes Rbac ExploitationExploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.Votes: 0GitHub stars: 22
- Lateral MovementActive Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.Votes: 0GitHub stars: 22
- Lattice Crypto AttacksLattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or applying LLL/BKZ reduction to cryptographic constructions.Votes: 0GitHub stars: 22
- Linux Capabilities PrivescIdentify and exploit misconfigured Linux Capabilities. This skill covers how attackers escalate privileges to root without relying on SUID binaries or kernel exploits by abusing excessive capabilities like cap_dac_read_search, cap_sys_ptrace, or cap_setuid assigned to ordinary files.Votes: 0GitHub stars: 22
- Linux Lateral MovementLinux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.Votes: 0GitHub stars: 22
- Linux Privilege EscalationLinux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.Votes: 0GitHub stars: 22
- Linux Security BypassLinux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.Votes: 0GitHub stars: 22
- Llm AttacksComplete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniquesVotes: 0GitHub stars: 22
- Llm Direct Prompt InjectionTest Large Language Models for direct prompt injection vulnerabilities where user input overrides system instructions, extracts system prompts, bypasses safety filters, or causes unauthorized actions. Use this skill when assessing chatbots, AI assistants, LLM-powered tools, or any application that processes natural language input through an LLM. Covers role-playing attacks, instruction hierarchy exploitation, multi-turn manipulation, and context window abuse for comprehensive AI security test...Votes: 0GitHub stars: 22
- Llm Indirect Prompt InjectionTest for indirect prompt injection vulnerabilities where malicious instructions are injected through external data sources (websites, emails, documents, database records) that the LLM processes. Use this skill when assessing LLM-integrated applications that process user-generated content, retrieve web pages, parse emails, or read documents. Covers injection via web content, email bodies, user profiles, and database records that are fed to LLM context.Votes: 0GitHub stars: 22
- Llm Jailbreaking PersonasExecute advanced LLM Jailbreaking techniques using roleplay, nested environments (virtual machines), and complex personas to completely bypass safety constraints and ethical alignments embedded in AI models.Votes: 0GitHub stars: 22
- Llm Jailbreaking TechniquesSystematically bypass LLM safety filters and content moderation systems using advanced jailbreaking techniques. Use this skill when testing AI systems for safety alignment robustness, evaluating content moderation effectiveness, or conducting authorized AI red team assessments. Covers role-play attacks, few-shot manipulation, encoding bypass, multi-modal exploitation, and automated jailbreak discovery methods.Votes: 0GitHub stars: 22
- Llm Overreliance HallucinationExploit an application's absolute trust in its underlying LLM (Overreliance). Use this skill to induce critical "hallucinations" (confident falsehoods) that cause downstream logical systems or automated agents tracking the LLM's output to make destructive actions or grant unauthorized access.Votes: 0GitHub stars: 22
- Llm Prompt Injection IndirectExploit AI applications using Indirect Prompt Injection. This skill focuses on hiding malicious instructions within data sources (web pages, documents, emails) that the LLM processes, causing the AI to execute unintended actions or leak data without direct user interaction.Votes: 0GitHub stars: 22
- Llm Prompt InjectionLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.Votes: 0GitHub stars: 22
- Llm Supply Chain PoisoningIdentify and exploit vulnerabilities in the AI Supply Chain by injecting malicious models, datasets, or dependencies. Use this skill to simulate advanced persistent threats (APTs) compromising Hugging Face repositories, manipulating pre-trained weights (Model Poisoning), and exploiting insecure deserialization during model loading (e.g., Pickle files).Votes: 0GitHub stars: 22
- Llm Training Data ExtractionExtract sensitive training data (PII, API keys, intellectual property, or code) directly from a deployed Large Language Model (LLM). This AI Red Teaming skill focuses on forcing models to regurgitate memorized, unredacted data from their massive internet-scraped datasets through repetition attacks, prefix continuation, and context window manipulation.Votes: 0GitHub stars: 22
- Macos Process InjectionmacOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.Votes: 0GitHub stars: 22
- Macos Security BypassmacOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.Votes: 0GitHub stars: 22
- Macos Unified Log AnalysisPerform forensic analysis of the macOS Unified Logging System (ULS) to investigate system events, application crashes, kernel panics, and potential indicators of compromise (IoCs) such as persistence mechanisms or unauthorized access.Votes: 0GitHub stars: 22
- Mass Assignment ExploitationExploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.Votes: 0GitHub stars: 22
- Mass AssignmentUse when testing APIs and web frameworks for mass assignment vulnerabilities where user-controlled request body fields are bound directly to model attributes without a field allowlist. Trigger on: ORM update/create endpoints, REST APIs accepting JSON body, Rails strong parameters, Django model forms, Laravel fillable/guarded, Node.js Mongoose/Sequelize, PUT/PATCH requests, registration endpoints, profile update endpoints, GraphQL mutations. Detects privilege escalation via role/admin/isAdmin ...Votes: 0GitHub stars: 22
- Mcp Protocol ExploitationTest Model Context Protocol (MCP) servers and tool-calling systems for security vulnerabilities including tool injection, parameter manipulation, privilege escalation, and data exfiltration through AI agent tool interfaces. Use this skill when assessing MCP server implementations, AI agent tool integrations, or any system that exposes tools to language models. Covers tool confusion attacks, cross-tool exploitation, and MCP server hardening assessment.Votes: 0GitHub stars: 22
- Memory Forensics VolatilityMemory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.Votes: 0GitHub stars: 22