Penetration Testing Agent Skills

Detect and exploit Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in APIs and web applications.

Systematically fuzz web applications for hidden content and input validation vulnerabilities across directories, files, parameters, and authentication bypasses.

Exploit SSRF vulnerabilities in AWS EC2-hosted applications to extract IAM credentials and User Data from the Instance Metadata Service, including techniques for bypassing basic filters against IMDSv1.

Searches and extracts data from Burp Suite project files (.burp) using the burpsuite-project-file-parser extension, enabling regex searches on response headers and bodies, extraction of security audit findings, and analysis of proxy history and site map data.

Authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

Reverse-engineers custom JavaScript-based WASM virtual machines and risk-control engines by identifying DSL VM patterns, extracting opcodes, analyzing constant tables, and tracing exported functions through static analysis and runtime injection.

Inspects web behavior, browser state, server routing, API order, and worker-backed application flow within a sandboxed CTF environment.

Analyze PCAP files by reconstructing TCP/UDP sessions, decoding application-layer protocols, and correlating packet sequences with host or malware behavior for CTF challenges.

Traces which sandbox node, proxy rule, or header-derived branch serves a live request in a CTF competition environment.

Runs a structured 6-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring playbooks.

Runs security audits, threat modeling, and hardening for code and infrastructure, covering OWASP checks, code review, incident response, and red/blue team exercises.

Hunt Client-Side Path Traversal vulnerabilities where attacker-controlled input is concatenated into the path of a fetch() or XHR request, enabling redirection and chaining to XSS or data exfiltration.

Routes authentication and authorization testing efforts by identifying the primary attack surface — login mechanics, object authorization, browser trust boundaries, or identity protocols such as JWT/OAuth/SAML — before selecting a deeper skill.

Audits email infrastructure security by testing SPF, DKIM, DMARC, open relay, spoofing resilience, MTA-STS, TLS-RPT, and SMTP configuration using standard security tools.

Configure and test common network services (HTTP, HTTPS, SNMP, SMB) for penetration testing lab environments, enabling hands-on practice with service enumeration, log analysis, and security testing.

Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.

Guides authorized RF/SDR security research for signal identification, demodulation analysis, and replay feasibility studies in shielded lab environments.

Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.

Generates task-oriented technical documentation with progressive disclosure for READMEs, API docs, architecture docs, and security reports after reverse engineering, penetration testing, or CTF tasks.

Guides blue-team threat hunting and detection engineering with hypothesis-driven workflows, Sigma/YARA rule creation, SIEM query design, and validation using Atomic Red Team in authorized environments.

Performs authorized database security assessments across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis, checking exposure, authentication, authorization, dangerous configurations, and exploit paths.

Analyzes vendor security patches via binary diffing to reverse-engineer vulnerabilities, write proof-of-concept exploits, and weaponize N-day exploits against unpatched systems.

Analyze the structure, boot chain, and update mechanism of a firmware image, then trace the shortest path to the decisive artifact or secret.

Bypasses safety filters on API-served LLMs using jailbreak templates, input obfuscation, and multi-model racing.

Provides a structured deep-dive into CORS misconfiguration vulnerabilities with exact payloads for every PortSwigger lab variant, including zero-day escalation techniques and blue-team detection guidance.

Detect and exploit Server-Side Template Injection vulnerabilities across multiple template engines including Jinja2, Twig, Freemarker, and Velocity, with payloads for sandbox escape and remote code execution. Includes detection methodology, bypass techniques, and fix patterns.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.

Provides exact payloads and bypass techniques for every PortSwigger DOM-based vulnerability lab variant, including zero-day extensions and blue team detection strategies.

Exploits file upload vulnerabilities across PortSwigger lab variants with exact payloads, bypass techniques, and zero-day escalation methods.