Security

abelrguezr Bundle

Audit applications for ORM injection vulnerabilities across Django, Prisma, Beego, Entity Framework, and Ransack. Use this skill whenever you need to test for database query manipulation, filter bypass, relational traversal attacks, or data exfiltration through ORM layers. Trigger this skill for any security audit involving user-controlled database queries, API endpoints with filtering, or applications using ORM frameworks with dynamic query construction.

abelrguezr Bundle

Techniques for bypassing captchas during authorized security testing and penetration testing. Use this skill whenever you're testing web applications and encounter captcha challenges that need to be automated or bypassed for testing purposes. This includes penetration testing, security assessments, and authorized vulnerability scanning. Don't use this for unauthorized access or malicious purposes.

abelrguezr Bundle

Use this skill whenever you need to test for LDAP injection vulnerabilities, analyze LDAP queries, or perform LDAP security assessments. Trigger this skill for any LDAP-related security testing, authentication bypass attempts, directory service penetration testing, or when investigating web applications that use LDAP for authentication. Don't forget to use this skill when you see login forms, directory services, or any application that might be vulnerable to LDAP injection attacks.

abelrguezr Bundle

How to identify and exploit race condition vulnerabilities in web applications. Use this skill whenever the user mentions race conditions, TOCTOU attacks, concurrent request exploitation, HTTP/2 single-packet attacks, limit-overrun vulnerabilities, hidden substates, or timing-based security bypasses. Also trigger when users want to test for race conditions in authentication flows, payment systems, coupon redemption, email verification, OAuth token generation, or any stateful web application logic.

abelrguezr Bundle

Security testing skill for identifying password reset vulnerabilities. Use this skill whenever the user needs to test password reset functionality for security flaws, audit authentication flows, or assess reset token security. Trigger on requests about password reset testing, authentication bypass, token leakage, reset endpoint security, or any password recovery mechanism assessment. Make sure to use this skill for any pentesting task involving password reset flows, even if the user doesn't explicitly mention 'password reset' but describes authentication or account recovery testing.

abelrguezr Bundle

How to test for NoSQL injection vulnerabilities in MongoDB and other NoSQL databases. Use this skill whenever the user mentions NoSQL injection, MongoDB injection, database injection testing, authentication bypass, or wants to test for NoSQL vulnerabilities in web applications. Make sure to use this skill for any security testing involving MongoDB, Mongoose, or NoSQL databases, even if the user doesn't explicitly mention 'injection'.

abelrguezr Bundle

How to test for and exploit XPath injection vulnerabilities in web applications. Use this skill whenever the user mentions XPath injection, XML query vulnerabilities, authentication bypass via XPath, blind XPath attacks, OOB XPath exploitation, or needs to enumerate XML schemas through XPath. Trigger this skill for any security testing involving XML-based authentication, login forms with XML backends, or when analyzing applications that construct XPath queries from user input.

abelrguezr Bundle

How to systematically search for exploits and vulnerabilities for any service, software, or technology. Use this skill whenever the user mentions finding exploits, searching for vulnerabilities, penetration testing, security research, or needs to check if a service/version has known exploits. Trigger on keywords like "exploit", "vulnerability", "CVE", "searchsploit", "exploitdb", "metasploit", "penetration test", "security audit", or when investigating a specific service/version for weaknesses.

abelrguezr Bundle

How to identify and test email injection vulnerabilities in web applications. Use this skill whenever the user mentions email injection, header injection, PHP mail exploitation, email bypass techniques, SSO email attacks, or any email-related security testing. This includes testing for Cc/Bcc injection, To header manipulation, subject/body injection, PHP mail() function abuse, email name bypass techniques, and third-party SSO email attacks.

abelrguezr Bundle

Pentest gRPC-Web services and endpoints. Use this skill whenever the user mentions gRPC-Web, gRPC over HTTP, protobuf services, Envoy proxies, or wants to test/audit gRPC-Web APIs. Trigger for any gRPC-Web reconnaissance, payload manipulation, CORS testing, or JavaScript bundle analysis tasks.

abelrguezr Bundle

Use this skill whenever you encounter cryptography challenges, CTF crypto problems, encoded data, hashes, ciphers, or any security-related encryption/decryption tasks. Make sure to use this skill for any crypto CTF challenge, encoded strings, hash analysis, cipher breaking, or when you need to identify and peel layers of encoding/encryption.

abelrguezr Bundle

How to identify, test, and exploit command injection vulnerabilities in web applications. Use this skill whenever the user mentions command injection, OS command injection, RCE through user input, shell metacharacters, or wants to test for arbitrary command execution. Also trigger when users discuss vulnerable parameters like cmd, exec, command, query, ping, or when they need to bypass input filters for security testing.

abelrguezr Bundle

Use this skill whenever testing rate limits, brute force protection, OTP verification, login throttling, or any API endpoint with request limits. Trigger on mentions of rate limiting, throttling, brute force, OTP bypass, login limits, API quotas, or when you need to test authentication security. This skill provides techniques to bypass rate limiting mechanisms during authorized security assessments.

abelrguezr Bundle

Audit web applications for UUID security vulnerabilities. Use this skill whenever you need to analyze UUID implementations, identify predictable UUID patterns, assess password reset token security, or perform security testing on any system using UUIDs. Trigger this skill for any request about UUID security, identifier predictability, token brute-force risks, or when reviewing authentication/authorization systems that use UUIDs.

abelrguezr Bundle

Perform WebSocket security testing including enumeration, fuzzing, CSWSH detection, and vulnerability assessment. Use this skill whenever the user mentions WebSocket testing, real-time communication security, wss/ws endpoints, cross-site WebSocket hijacking, or needs to audit WebSocket implementations for vulnerabilities like race conditions, prototype pollution, or authentication bypass.

abelrguezr Bundle

How to identify and exploit array indexing vulnerabilities in binary exploitation challenges. Use this skill whenever the user mentions array bounds, index manipulation, off-by-one errors, array overflows, heap corruption through arrays, or any CTF/binary challenge involving array access. This skill covers colliding arrays, size field overwrites, GOT corruption, ROP chains triggered by array bugs, and heap exploitation through index manipulation. Make sure to use this skill for any binary exploitation task involving arrays, even if the user doesn't explicitly mention "array indexing" or "bounds checking".

abelrguezr Bundle

Android APK penetration testing methodology and checklist. Use this skill whenever analyzing Android applications for security vulnerabilities, performing mobile app security assessments, reverse engineering APKs, or conducting static/dynamic analysis of Android apps. Trigger for any Android security testing, APK analysis, mobile pentesting, or when investigating Android app vulnerabilities including exported components, insecure data storage, crypto issues, intent-based attacks, WebView exploits, or Play Integrity bypasses.

abelrguezr Bundle

How to implement supervised machine learning algorithms for cybersecurity tasks like intrusion detection, malware classification, phishing detection, and spam filtering. Use this skill whenever the user mentions machine learning, ML models, classification, regression, cybersecurity datasets, NSL-KDD, phishing detection, intrusion detection, malware analysis, or wants to build predictive models for security applications. This skill covers Linear Regression, Logistic Regression, Decision Trees, Random Forests, SVM, Naive Bayes, k-NN, and Gradient Boosting with ready-to-use Python code.

abelrguezr Bundle

Security education skill for understanding reverse shell techniques to improve defensive security posture. Use this skill when users ask about reverse shells, shell connections, or need to understand how attackers establish remote access for authorized security testing, incident response, or defensive hardening. This skill focuses on detection, prevention, and authorized testing only.

abelrguezr Bundle

Pentest network printers via PJL (Printer Job Language) on port 9100/tcp. Use this skill whenever the user mentions printer security, port 9100, JetDirect, AppSocket, PJL commands, printer enumeration, printer exploitation, PRET tool, or any printer-related security testing. This includes tasks like enumerating printer info, accessing printer filesystems, uploading/downloading files, or exploiting printer vulnerabilities like TrueType VM bugs.

abelrguezr Bundle

Security testing skill for auditing JSON, XML, and YAML parser vulnerabilities. Use this skill whenever you need to test for deserialization attacks, parser inconsistencies, duplicate field exploits, case-insensitivity bypasses, or data format confusion attacks. Trigger this skill for any security audit involving data parsing, API input validation, authentication bypass testing, or when reviewing code that handles JSON/XML/YAML deserialization. Don't skip this skill when testing web applications, microservices, or any system that parses structured data from untrusted sources.

abelrguezr Bundle

Reference for Windows APIs commonly used in malware, malware analysis techniques, and detection strategies. Use this skill whenever the user mentions malware analysis, reversing, Windows API calls, process injection, DLL injection, process hollowing, anti-analysis techniques, threat hunting, detection rules, or any security research involving Windows executables. Trigger even if they don't explicitly say "malware" but describe suspicious behavior, API sequences, or need to understand how malware evades detection.

abelrguezr Bundle

Guide for Chrome browser exploitation research and full-chain vulnerability analysis. Use this skill when researching Chrome security, analyzing browser vulnerabilities, developing proof-of-concepts for CVEs, or understanding Chrome's multi-layered sandbox architecture. Trigger this skill for any Chrome exploitation questions, V8 sandbox escape techniques, Mojo IPC abuse, WebAssembly JIT bugs, or when setting up Chrome debugging environments for security research.

abelrguezr Bundle

How to assess payment process security during authorized penetration testing. Use this skill whenever the user mentions payment security testing, transaction flow analysis, payment gateway assessment, or needs to evaluate payment system vulnerabilities in an authorized security engagement. This skill helps identify potential weaknesses in payment flows, parameter handling, and session management for legitimate security audits.

abelrguezr Bundle

Reference guide for Windows reverse shell techniques used in authorized penetration testing and security research. Use this skill when the user asks about Windows reverse shells, LOLBins for code execution, or needs to understand Windows-based remote access techniques for security assessments. Make sure to use this skill whenever the user mentions reverse shells, Windows exploitation, LOLBins, or security testing on Windows systems, even if they don't explicitly ask for a 'reference guide'.

abelrguezr Bundle

Test file upload vulnerabilities and bypass protections. Use this skill whenever the user needs to assess file upload security, test extension bypasses, create polyglot files, or exploit upload handlers. Trigger on requests about file upload testing, webshell deployment, extension bypass, magic number bypass, or any upload-related security assessment.

abelrguezr Bundle

How to find and exploit mass assignment vulnerabilities (CWE-915) for privilege escalation. Use this skill whenever you need to test APIs for insecure object binding, when analyzing self-service endpoints like /api/users/{id} or /profile, when you see JSON responses echoing server-managed fields like roles, isAdmin, status, or permissions, or when you want to enumerate bindable schema from client bundles. Make sure to use this skill for any API security testing involving user profile updates, order modifications, or any PUT/PATCH endpoints that accept JSON bodies.

abelrguezr Bundle

Test phone number input fields for injection vulnerabilities including XSS, SQLi, SSRF, and OTP bypass attacks. Use this skill whenever you need to assess web application security, test form inputs, audit phone number fields, or investigate potential injection points in user-submitted data. Don't skip this when reviewing any form that accepts phone numbers - these fields are commonly overlooked attack vectors.

abelrguezr Bundle

How to understand and exploit libc heap vulnerabilities in glibc and musl allocators. Use this skill whenever the user mentions heap exploitation, malloc/free vulnerabilities, chunk manipulation, arena analysis, bin attacks, or any heap-related binary exploitation tasks. Also trigger for debugging heap corruption, analyzing malloc_state structures, or working with heap chunks in GDB/pwndbg.

abelrguezr Bundle

Generate MSFVenom payloads for penetration testing and security research. Use this skill whenever the user needs to create reverse shells, bind shells, or other payloads for Windows, Linux, macOS, web applications (PHP, ASP, JSP, WAR), or script languages (Python, Perl, Bash). Trigger on requests for payload generation, shellcode creation, meterpreter payloads, or any MSFVenom command construction. Also use when users mention LHOST, LPORT, payload formats, or need to embed payloads in executables.

abelrguezr Bundle

How to enumerate and exploit TFTP (Trivial File Transfer Protocol) services on UDP port 69. Use this skill whenever you need to scan for TFTP services, enumerate files on TFTP servers, download or upload files via TFTP, or assess TFTP security during penetration testing. Trigger this skill for any task involving port 69/UDP, TFTP brute-forcing, file transfer via TFTP, or when you discover an open TFTP service during network reconnaissance.

abelrguezr Bundle

Security Assertion Markup Language (SAML) reference for security testing and analysis. Use this skill whenever you need to understand SAML authentication flows, analyze SAML requests/responses, work with XML signatures, or investigate SAML-based SSO implementations. Trigger this skill for any SAML-related security assessment, SSO testing, or when examining SAML protocol messages in pentesting scenarios.

abelrguezr Bundle

IPMI (Intelligent Platform Management Interface) pentesting and exploitation. Use this skill whenever the user needs to discover, enumerate, or exploit IPMI services on port 623/UDP/TCP, test for IPMI vulnerabilities (cipher 0, RAKP, anonymous auth), attempt default credentials, access hosts via BMC/KVM, or create backdoors in BMC from compromised hosts. Trigger for any IPMI-related security assessment, remote management interface testing, or BMC exploitation tasks.

abelrguezr Bundle

Security testing for OAuth 2.0 and OIDC implementations. Use this skill whenever the user mentions OAuth, authentication flows, account takeover, identity providers, SSO, login flows, authorization codes, access tokens, or any security testing related to third-party authentication. This skill helps identify vulnerabilities like open redirect_uri, CSRF state issues, token leakage, client secret exposure, and other OAuth misconfigurations that lead to account compromise.

abelrguezr Bundle

Security testing skill for SAML vulnerabilities. Use this skill whenever the user needs to test SAML implementations for security issues, analyze SAML responses, perform signature wrapping attacks, test for XXE/XSLT injection, check certificate validation, or investigate SAML-related XSS. Trigger on any request involving SAML security testing, SAML response analysis, SAML attack methodology, or SAML vulnerability assessment.

abelrguezr Bundle

How to assess, test, and harden Windows Remote Management (WinRM) configurations. Use this skill whenever the user mentions WinRM, Windows remote management, lateral movement via WinRM, needs to audit/harden WinRM settings on Windows systems, or is working on Windows security hardening. Make sure to use this skill for any WinRM-related security assessment, configuration review, or hardening task.