yaklang/hack-skills
- skills.sh installs
- 392.3K
- skills
- 102
Install
$ npx -y skills add yaklang/hack-skills --agent claude-codeInstalls into .claude/skills of the current project.
Skills
1
hackyaklang/hack-skillsEntry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path p4.6Kskills.sh installs
hackyaklang/hack-skillsEntry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path p4.6Kskills.sh installs2android-pentesting-tricksyaklang/hack-skillsAndroid pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection4.3Kskills.sh installs
android-pentesting-tricksyaklang/hack-skillsAndroid pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection4.3Kskills.sh installs3recon-and-methodologyyaklang/hack-skillsReconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a4.3Kskills.sh installs
recon-and-methodologyyaklang/hack-skillsReconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a4.3Kskills.sh installs4sqli-sql-injectionyaklang/hack-skillsSQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution 4.2Kskills.sh installs
sqli-sql-injectionyaklang/hack-skillsSQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution 4.2Kskills.sh installs5code-obfuscation-deobfuscationyaklang/hack-skillsCode obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow f4.2Kskills.sh installs
code-obfuscation-deobfuscationyaklang/hack-skillsCode obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow f4.2Kskills.sh installs6xss-cross-site-scriptingyaklang/hack-skillsXSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.4.2Kskills.sh installs
xss-cross-site-scriptingyaklang/hack-skillsXSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.4.2Kskills.sh installs7api-secyaklang/hack-skillsEntry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API4.1Kskills.sh installs
api-secyaklang/hack-skillsEntry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API4.1Kskills.sh installs8business-logic-vulnerabilitiesyaklang/hack-skillsBusiness logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step aut4.1Kskills.sh installs
business-logic-vulnerabilitiesyaklang/hack-skillsBusiness logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step aut4.1Kskills.sh installs9ssrf-server-side-request-forgeryyaklang/hack-skillsSSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secon4.1Kskills.sh installs
ssrf-server-side-request-forgeryyaklang/hack-skillsSSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secon4.1Kskills.sh installs10idor-broken-object-authorizationyaklang/hack-skillsIDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level 4Kskills.sh installs
idor-broken-object-authorizationyaklang/hack-skillsIDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level 4Kskills.sh installs11authbypass-authentication-flawsyaklang/hack-skillsAuthentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force re4Kskills.sh installs
authbypass-authentication-flawsyaklang/hack-skillsAuthentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force re4Kskills.sh installs12jwt-oauth-token-attacksyaklang/hack-skillsJWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding wea4Kskills.sh installs
jwt-oauth-token-attacksyaklang/hack-skillsJWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding wea4Kskills.sh installs13api-recon-and-docsyaklang/hack-skillsAPI reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API te4Kskills.sh installs
api-recon-and-docsyaklang/hack-skillsAPI reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API te4Kskills.sh installs14401-403-bypass-techniquesyaklang/hack-skills401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP metho4Kskills.sh installs
401-403-bypass-techniquesyaklang/hack-skills401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP metho4Kskills.sh installs15api-auth-and-jwt-abuseyaklang/hack-skillsAPI authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses4Kskills.sh installs
api-auth-and-jwt-abuseyaklang/hack-skillsAPI authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses4Kskills.sh installs16waf-bypass-techniquesyaklang/hack-skillsWAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypa4Kskills.sh installs
waf-bypass-techniquesyaklang/hack-skillsWAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypa4Kskills.sh installs17vm-and-bytecode-reverseyaklang/hack-skillsCustom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, 4Kskills.sh installs
vm-and-bytecode-reverseyaklang/hack-skillsCustom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, 4Kskills.sh installs18websocket-securityyaklang/hack-skillsWebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.4Kskills.sh installs
websocket-securityyaklang/hack-skillsWebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.4Kskills.sh installs19api-authorization-and-bolayaklang/hack-skillsAPI authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authoriza3.9Kskills.sh installs
api-authorization-and-bolayaklang/hack-skillsAPI authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authoriza3.9Kskills.sh installs20auth-secyaklang/hack-skillsEntry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterpr3.9Kskills.sh installs
auth-secyaklang/hack-skillsEntry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterpr3.9Kskills.sh installs21kubernetes-pentestingyaklang/hack-skillsKubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet AP3.9Kskills.sh installs
kubernetes-pentestingyaklang/hack-skillsKubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet AP3.9Kskills.sh installs22cors-cross-origin-misconfigurationyaklang/hack-skillsCORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser3.9Kskills.sh installs
cors-cross-origin-misconfigurationyaklang/hack-skillsCORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser3.9Kskills.sh installs23ios-pentesting-tricksyaklang/hack-skillsiOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, bi3.9Kskills.sh installs
ios-pentesting-tricksyaklang/hack-skillsiOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, bi3.9Kskills.sh installs24injection-checkingyaklang/hack-skillsEntry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on h3.9Kskills.sh installs
injection-checkingyaklang/hack-skillsEntry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on h3.9Kskills.sh installs25recon-for-secyaklang/hack-skillsEntry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory,3.9Kskills.sh installs
recon-for-secyaklang/hack-skillsEntry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory,3.9Kskills.sh installs26llm-prompt-injectionyaklang/hack-skillsLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MC3.9Kskills.sh installs
llm-prompt-injectionyaklang/hack-skillsLLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MC3.9Kskills.sh installs27heap-exploitationyaklang/hack-skillsHeap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache3.9Kskills.sh installs
heap-exploitationyaklang/hack-skillsHeap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache3.9Kskills.sh installs28csrf-cross-site-request-forgeryyaklang/hack-skillsCSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.3.9Kskills.sh installs
csrf-cross-site-request-forgeryyaklang/hack-skillsCSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.3.9Kskills.sh installs29business-logic-vulnyaklang/hack-skillsEntry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parse3.9Kskills.sh installs
business-logic-vulnyaklang/hack-skillsEntry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parse3.9Kskills.sh installs30traffic-analysis-pcapyaklang/hack-skillsTraffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), d3.9Kskills.sh installs
traffic-analysis-pcapyaklang/hack-skillsTraffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), d3.9Kskills.sh installs31oauth-oidc-misconfigurationyaklang/hack-skillsOAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, 3.9Kskills.sh installs
oauth-oidc-misconfigurationyaklang/hack-skillsOAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, 3.9Kskills.sh installs32anti-debugging-techniquesyaklang/hack-skillsAnti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/except3.9Kskills.sh installs
anti-debugging-techniquesyaklang/hack-skillsAnti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/except3.9Kskills.sh installs33binary-protection-bypassyaklang/hack-skillsBinary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF bi3.9Kskills.sh installs
binary-protection-bypassyaklang/hack-skillsBinary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF bi3.9Kskills.sh installs34cmdi-command-injectionyaklang/hack-skillsCommand injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.3.9Kskills.sh installs
cmdi-command-injectionyaklang/hack-skillsCommand injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.3.9Kskills.sh installs35path-traversal-lfiyaklang/hack-skillsPath traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem cont3.9Kskills.sh installs
path-traversal-lfiyaklang/hack-skillsPath traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem cont3.9Kskills.sh installs36ssti-server-side-template-injectionyaklang/hack-skillsSSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.3.8Kskills.sh installs
ssti-server-side-template-injectionyaklang/hack-skillsSSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.3.8Kskills.sh installs37graphql-and-hidden-parametersyaklang/hack-skillsGraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL aut3.8Kskills.sh installs
graphql-and-hidden-parametersyaklang/hack-skillsGraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL aut3.8Kskills.sh installs38kernel-exploitationyaklang/hack-skillsLinux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_cr3.8Kskills.sh installs
kernel-exploitationyaklang/hack-skillsLinux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_cr3.8Kskills.sh installs39race-conditionyaklang/hack-skillsRace condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 sin3.8Kskills.sh installs
race-conditionyaklang/hack-skillsRace condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 sin3.8Kskills.sh installs40xxe-xml-external-entityyaklang/hack-skillsXXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.3.8Kskills.sh installs
xxe-xml-external-entityyaklang/hack-skillsXXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.3.8Kskills.sh installs41deserialization-insecureyaklang/hack-skillsInsecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar 3.8Kskills.sh installs
deserialization-insecureyaklang/hack-skillsInsecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar 3.8Kskills.sh installs42request-smugglingyaklang/hack-skillsHTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Lengt3.8Kskills.sh installs
request-smugglingyaklang/hack-skillsHTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Lengt3.8Kskills.sh installs43file-access-vulnyaklang/hack-skillsEntry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipe3.8Kskills.sh installs
file-access-vulnyaklang/hack-skillsEntry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipe3.8Kskills.sh installs44format-string-exploitationyaklang/hack-skillsFormat string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary 3.8Kskills.sh installs
format-string-exploitationyaklang/hack-skillsFormat string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary 3.8Kskills.sh installs45http-parameter-pollutionyaklang/hack-skillsHTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application lay3.8Kskills.sh installs
http-parameter-pollutionyaklang/hack-skillsHTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application lay3.8Kskills.sh installs46csp-bypass-advancedyaklang/hack-skillsAdvanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint3.8Kskills.sh installs
csp-bypass-advancedyaklang/hack-skillsAdvanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint3.8Kskills.sh installs47browser-exploitation-v8yaklang/hack-skillsBrowser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 s3.8Kskills.sh installs
browser-exploitation-v8yaklang/hack-skillsBrowser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 s3.8Kskills.sh installs48open-redirectyaklang/hack-skillsOpen redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled dest3.8Kskills.sh installs
open-redirectyaklang/hack-skillsOpen redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled dest3.8Kskills.sh installs49symbolic-execution-toolsyaklang/hack-skillsSymbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis 3.8Kskills.sh installs
symbolic-execution-toolsyaklang/hack-skillsSymbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, bypassing checks, or automating binary analysis 3.8Kskills.sh installs50crlf-injectionyaklang/hack-skillsCRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed 3.8Kskills.sh installs
crlf-injectionyaklang/hack-skillsCRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed 3.8Kskills.sh installs51insecure-source-code-managementyaklang/hack-skillsSource control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authori3.8Kskills.sh installs
insecure-source-code-managementyaklang/hack-skillsSource control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authori3.8Kskills.sh installs52mobile-ssl-pinning-bypassyaklang/hack-skillsMobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI3.8Kskills.sh installs
mobile-ssl-pinning-bypassyaklang/hack-skillsMobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI3.8Kskills.sh installs53http-host-header-attacksyaklang/hack-skillsHTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control 3.8Kskills.sh installs
http-host-header-attacksyaklang/hack-skillsHTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control 3.8Kskills.sh installs54web-cache-deceptionyaklang/hack-skillsWeb cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to 3.8Kskills.sh installs
web-cache-deceptionyaklang/hack-skillsWeb cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to 3.8Kskills.sh installs55subdomain-takeoveryaklang/hack-skillsSubdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired th3.8Kskills.sh installs
subdomain-takeoveryaklang/hack-skillsSubdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired th3.8Kskills.sh installs56dependency-confusionyaklang/hack-skillsSupply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to maliciou3.8Kskills.sh installs
dependency-confusionyaklang/hack-skillsSupply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to maliciou3.8Kskills.sh installs57expression-language-injectionyaklang/hack-skillsExpression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence,3.8Kskills.sh installs
expression-language-injectionyaklang/hack-skillsExpression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence,3.8Kskills.sh installs58csv-formula-injectionyaklang/hack-skillsCSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tool3.8Kskills.sh installs
csv-formula-injectionyaklang/hack-skillsCSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tool3.8Kskills.sh installs59active-directory-acl-abuseyaklang/hack-skillsActive Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS r3.8Kskills.sh installs
active-directory-acl-abuseyaklang/hack-skillsActive Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS r3.8Kskills.sh installs60linux-privilege-escalationyaklang/hack-skillsLinux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse,3.8Kskills.sh installs
linux-privilege-escalationyaklang/hack-skillsLinux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse,3.8Kskills.sh installs61clickjackingyaklang/hack-skillsClickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether 3.8Kskills.sh installs
clickjackingyaklang/hack-skillsClickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether 3.8Kskills.sh installs62active-directory-kerberos-attacksyaklang/hack-skillsKerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegatio3.8Kskills.sh installs
active-directory-kerberos-attacksyaklang/hack-skillsKerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegatio3.8Kskills.sh installs63jndi-injectionyaklang/hack-skillsJNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reachin3.8Kskills.sh installs
jndi-injectionyaklang/hack-skillsJNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reachin3.8Kskills.sh installs64http2-specific-attacksyaklang/hack-skillsHTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, 3.8Kskills.sh installs
http2-specific-attacksyaklang/hack-skillsHTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, 3.8Kskills.sh installs65saml-sso-assertion-attacksyaklang/hack-skillsSAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and en3.8Kskills.sh installs
saml-sso-assertion-attacksyaklang/hack-skillsSAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and en3.8Kskills.sh installs66arbitrary-write-to-rceyaklang/hack-skillsArbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it int3.8Kskills.sh installs
arbitrary-write-to-rceyaklang/hack-skillsArbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it int3.8Kskills.sh installs67active-directory-certificate-servicesyaklang/hack-skillsAD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment3.8Kskills.sh installs
active-directory-certificate-servicesyaklang/hack-skillsAD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment3.8Kskills.sh installs68hash-attack-techniquesyaklang/hack-skillsHash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and aut3.8Kskills.sh installs
hash-attack-techniquesyaklang/hack-skillsHash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and aut3.8Kskills.sh installs69prototype-pollutionyaklang/hack-skillsPrototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring librar3.8Kskills.sh installs
prototype-pollutionyaklang/hack-skillsPrototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring librar3.8Kskills.sh installs70dns-rebinding-attacksyaklang/hack-skillsDNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, 3.8Kskills.sh installs
dns-rebinding-attacksyaklang/hack-skillsDNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, 3.8Kskills.sh installs71network-protocol-attacksyaklang/hack-skillsNetwork protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN 3.8Kskills.sh installs
network-protocol-attacksyaklang/hack-skillsNetwork protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN 3.8Kskills.sh installs72ai-ml-securityyaklang/hack-skillsAI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, da3.8Kskills.sh installs
ai-ml-securityyaklang/hack-skillsAI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, da3.8Kskills.sh installs73memory-forensics-volatilityyaklang/hack-skillsMemory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injecti3.8Kskills.sh installs
memory-forensics-volatilityyaklang/hack-skillsMemory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injecti3.8Kskills.sh installs74dangling-markup-injectionyaklang/hack-skillsDangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks sc3.8Kskills.sh installs
dangling-markup-injectionyaklang/hack-skillsDangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks sc3.8Kskills.sh installs75windows-av-evasionyaklang/hack-skillsAV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-b3.8Kskills.sh installs
windows-av-evasionyaklang/hack-skillsAV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-b3.8Kskills.sh installs76defi-attack-patternsyaklang/hack-skillsDeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilitie3.8Kskills.sh installs
defi-attack-patternsyaklang/hack-skillsDeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilitie3.8Kskills.sh installs77windows-privilege-escalationyaklang/hack-skillsWindows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, serv3.8Kskills.sh installs
windows-privilege-escalationyaklang/hack-skillsWindows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, serv3.8Kskills.sh installs78email-header-injectionyaklang/hack-skillsEmail header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages wit3.8Kskills.sh installs
email-header-injectionyaklang/hack-skillsEmail header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages wit3.8Kskills.sh installs79xslt-injectionyaklang/hack-skillsXSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlle3.8Kskills.sh installs
xslt-injectionyaklang/hack-skillsXSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlle3.8Kskills.sh installs80type-jugglingyaklang/hack-skillsPHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, 3.8Kskills.sh installs
type-jugglingyaklang/hack-skillsPHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, 3.8Kskills.sh installs81linux-lateral-movementyaklang/hack-skillsLinux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus3.8Kskills.sh installs
linux-lateral-movementyaklang/hack-skillsLinux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus3.8Kskills.sh installs82container-escape-techniquesyaklang/hack-skillsContainer escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities3.8Kskills.sh installs
container-escape-techniquesyaklang/hack-skillsContainer escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities3.8Kskills.sh installs83classical-cipher-analysisyaklang/hack-skillsClassical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires fr3.7Kskills.sh installs
classical-cipher-analysisyaklang/hack-skillsClassical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires fr3.7Kskills.sh installs84linux-security-bypassyaklang/hack-skillsLinux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit l3.7Kskills.sh installs
linux-security-bypassyaklang/hack-skillsLinux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit l3.7Kskills.sh installs85tunneling-and-pivotingyaklang/hack-skillsTunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTT3.7Kskills.sh installs
tunneling-and-pivotingyaklang/hack-skillsTunneling and pivoting playbook. Use when establishing network tunnels through compromised hosts including SSH tunneling, Chisel, Ligolo-ng, socat, DNS/ICMP/HTT3.7Kskills.sh installs86prototype-pollution-advancedyaklang/hack-skillsAdvanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ fo3.7Kskills.sh installs
prototype-pollution-advancedyaklang/hack-skillsAdvanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ fo3.7Kskills.sh installs87steganography-techniquesyaklang/hack-skillsSteganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appen3.7Kskills.sh installs
steganography-techniquesyaklang/hack-skillsSteganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appen3.7Kskills.sh installs88smart-contract-vulnerabilitiesyaklang/hack-skillsSmart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, sign3.7Kskills.sh installs
smart-contract-vulnerabilitiesyaklang/hack-skillsSmart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, sign3.7Kskills.sh installs89stack-overflow-and-ropyaklang/hack-skillsStack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dl3.7Kskills.sh installs
stack-overflow-and-ropyaklang/hack-skillsStack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dl3.7Kskills.sh installs90rsa-attack-techniquesyaklang/hack-skillsRSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small e3.7Kskills.sh installs
rsa-attack-techniquesyaklang/hack-skillsRSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small e3.7Kskills.sh installs91sandbox-escape-techniquesyaklang/hack-skillsSandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isol3.7Kskills.sh installs
sandbox-escape-techniquesyaklang/hack-skillsSandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isol3.7Kskills.sh installs92lattice-crypto-attacksyaklang/hack-skillsLattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or a3.7Kskills.sh installs
lattice-crypto-attacksyaklang/hack-skillsLattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or a3.7Kskills.sh installs93symmetric-cipher-attacksyaklang/hack-skillsSymmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reus3.7Kskills.sh installs
symmetric-cipher-attacksyaklang/hack-skillsSymmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reus3.7Kskills.sh installs94windows-lateral-movementyaklang/hack-skillsWindows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-tick3.7Kskills.sh installs
windows-lateral-movementyaklang/hack-skillsWindows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-tick3.7Kskills.sh installs95macos-security-bypassyaklang/hack-skillsmacOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protecti3.7Kskills.sh installs
macos-security-bypassyaklang/hack-skillsmacOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protecti3.7Kskills.sh installs96ntlm-relay-coercionyaklang/hack-skillsNTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay 3.7Kskills.sh installs
ntlm-relay-coercionyaklang/hack-skillsNTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay 3.7Kskills.sh installs97nosql-injectionyaklang/hack-skillsNoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.3.7Kskills.sh installs
nosql-injectionyaklang/hack-skillsNoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.3.7Kskills.sh installs98macos-process-injectionyaklang/hack-skillsmacOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XP3.7Kskills.sh installs
macos-process-injectionyaklang/hack-skillsmacOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XP3.7Kskills.sh installs99upload-insecure-filesyaklang/hack-skillsInsecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE cha3.7Kskills.sh installs
upload-insecure-filesyaklang/hack-skillsInsecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE cha3.7Kskills.sh installs100unauthorized-access-common-servicesyaklang/hack-skillsUnauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interface3.6Kskills.sh installs
unauthorized-access-common-servicesyaklang/hack-skillsUnauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interface3.6Kskills.sh installs101reverse-shell-techniquesyaklang/hack-skillsReverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY upg3.6Kskills.sh installs
reverse-shell-techniquesyaklang/hack-skillsReverse shell techniques playbook. Use when establishing remote shells including language one-liners, encrypted shells (OpenSSL/socat/ncat), web shells, PTY upg3.6Kskills.sh installs102ghost-bits-cast-attackyaklang/hack-skillsJava "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass 3.5Kskills.sh installs
ghost-bits-cast-attackyaklang/hack-skillsJava "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass 3.5Kskills.sh installs