Security

netvar1337 Bundle

Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks, protected binaries, or debugging security-sensitive game components.

netvar1337 Skill

Sidecar orchestrator for CTF / AWD / cyber range / sandbox multi-surface engagements. Takes over after the ctf-sandbox PRIMARY routes in: sets up the lab network profile, initializes the case with auth.status=granted, and dispatches each challenge to its specialist (pwn-chain, apk-reverse, ida-reverse/r2mcp-basic, api-security/pentest-tools) without inventing new workflows. Use when a CTF/cyber range task needs multi-challenge orchestration, case init, network profile scoping, or downstream routing decisions.

netvar1337 Bundle

Decompile Android APK, XAPK, AAB, DEX, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley, GraphQL, WebSocket), trace call flows from UI to network layer, analyze security patterns (cert pinning, exposed secrets, Android Fragment Injection via exported PreferenceActivity), perform dynamic analysis with Frida (adaptive bypass generation, crash analysis, runtime hooking), and — only when the decompiled app contains Google API keys or Firebase configuration — run a conditional Firebase & Google API testing phase (Auth, Realtime DB, Firestore, Remote Config, Storage, Dynamic Links, FCM, Gemini, Maps). Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, follow call flows, audit app security, bypass runtime protections, test exposed Google/Firebase credentials, or check for Fragment Injection exposure.

netvar1337 Bundle

Use when operating from an authorized Linux shell after initial access to build a host privilege graph, validate sudo/SUID/capability/systemd/container escalation edges, locate credentials with provenance, assess persistence and lateral paths, measure audit or EDR visibility, and prove cleanup.

netvar1337 Skill

Build reproducible exploit procedures from validated primitives with clear prerequisites, verification criteria, and safety boundaries.

netvar1337 Bundle

Full-chain engineering methodology for going from reverse engineering to a working exploit. Applicable scenarios: you have the binary + the vulnerability + the target environment, and need to write an exploit that reliably gets through (not a script that only reproduces locally once and crashes the moment it goes remote). Covers three major directions: stack overflow / heap exploitation / kernel pwn. Emphasizes the engineering gap between "CTF passes locally → real remote stable exploitation": libc version mismatch, heap spray timing, SMEP/SMAP/KASLR, stack alignment, remote buffering. Core toolchain: pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system kernel debugging. Trigger keywords: pwn, stack overflow, heap overflow, ROP, ret2libc, ret2csu, one_gadget, libc-database, heap exploitation, tcache, fastbin, unsorted bin, kernel pwn, kROP, SMEP, SMAP, KASLR, modprobe_path, pwntools, GEF, pwndbg.

netvar1337 Bundle

Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.

netvar1337 Bundle

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

netvar1337 Skill

Build an exhaustive map of attack entry points, trust boundaries, and dangerous sinks before exploit-focused code analysis.

netvar1337 Bundle

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.

netvar1337 Bundle

GraphQL security testing checklist: introspection abuse, batching attacks, query depth/complexity DoS, field suggestion enumeration, IDOR via GraphQL, injection through arguments, authorization bypass. Use when assessing GraphQL endpoints in web app tests or bug bounty.

netvar1337 Skill

Convert API vulnerability leads into confirmed impact or cleanly disproven outcomes with reproducible evidence.

netvar1337 Skill

Deepen preliminary web findings into validated exploit impact using independent confirmation and confidence grading.

netvar1337 Bundle

Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.

netvar1337 Skill

Execute end-to-end API security testing from attack-surface mapping through validated findings and remediation notes.

netvar1337 Skill

Perform exploit-oriented code review by proving attacker-controlled paths from source to sink and validating impact.

netvar1337 Bundle

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

netvar1337 Bundle

Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.

netvar1337 Bundle

Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: write report, write docs, produce a report, writeup, technical documentation, report, documentation.

netvar1337 Bundle

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

netvar1337 Bundle

Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

netvar1337 Bundle

Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.

wufufu770 Skill

Perform analyzing malicious pdf with peepdf assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing authenticated scan with openvas assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing web application penetration test assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform analyzing malware sandbox evasion techniques assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing privilege escalation assessment assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform analyzing malicious url with urlscan assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform analyzing network traffic of malware assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing firmware malware analysis assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing authenticated vulnerability scan assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing bluetooth security assessment assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform performing physical intrusion assessment assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform exploiting active directory with bloodhound assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform analyzing bootkit and rootkit samples assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

wufufu770 Skill

Perform bypassing authentication with forced browsing assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.