AI Skills

anti-debugging-techniques

Anti-debugging detection and bypass playbook

api-auth-and-jwt-abuse

API authentication and JWT abuse playbook

api-authorization-and-bola

API authorization and BOLA testing playbook

api-recon-and-docs

API reconnaissance and documentation review playbook

api-sec

Entry P1 category router for API security

arbitrary-write-to-rce

Arbitrary write to RCE playbook

auth-sec

Entry P1 category router for authentication and authorization

authbypass-authentication-flaws

Authentication bypass testing playbook

binary-protection-bypass

Binary protection bypass playbook

browser-exploitation-v8

Browser and V8 exploitation playbook

business-logic-vuln

Entry P1 category router for business logic testing

business-logic-vulnerabilities

Business logic vulnerability playbook

classical-cipher-analysis

Classical cipher analysis playbook

clickjacking

Clickjacking playbook

cmdi-command-injection

Command injection playbook

code-obfuscation-deobfuscation

Code obfuscation analysis and deobfuscation playbook

container-escape-techniques

Container escape playbook

cors-cross-origin-misconfiguration

CORS misconfiguration testing playbook

crlf-injection

CRLF injection playbook

csp-bypass-advanced

Advanced Content Security Policy bypass techniques

csrf-cross-site-request-forgery

CSRF testing playbook

csv-formula-injection

CSV/spreadsheet formula injection

dangling-markup-injection

Dangling markup injection playbook

defi-attack-patterns

DeFi attack pattern playbook

dependency-confusion

Supply-chain testing via package-manager dependency confusion

deserialization-insecure

Insecure deserialization playbook

dns-rebinding-attacks

DNS rebinding attack playbook

email-header-injection

Email header injection and spoofing playbook

expression-language-injection

Expression Language injection playbook

file-access-vuln

Entry P1 category router for file access and upload workflows

format-string-exploitation

Format string exploitation playbook

ghost-bits-cast-attack

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026)

goldie

Create App Store and Play Store screenshots and preview videos

graphql-and-hidden-parameters

GraphQL and hidden parameter testing playbook

hack

Entry P0 primary router and operating doctrine for HackSkills

hash-attack-techniques

Hash attack playbook

heap-exploitation

Heap exploitation playbook

http-host-header-attacks

HTTP Host header injection and routing abuse playbook

http-parameter-pollution

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently

http2-specific-attacks

HTTP/2 protocol-specific attack playbook

idor-broken-object-authorization

IDOR and broken object authorization testing playbook

injection-checking

Entry P1 category router for injection testing

insecure-source-code-management

Source control and artifact exposure (.git, .svn, .hg, backups, .env)

ios-pentesting-tricks

IOS pentesting playbook

jndi-injection

JNDI injection playbook

jwt-oauth-token-attacks

JWT and OAuth token attack playbook

kernel-exploitation

Linux kernel exploitation playbook

kubernetes-pentesting

Kubernetes penetration testing playbook

lattice-crypto-attacks

Lattice-based cryptanalysis playbook

linux-lateral-movement

Linux lateral movement playbook