Results for “url-scheme”
6 skills
zhaoxuya520 competition-ios-runtime
Analyzes iOS IPA bundles and hooks runtime behavior using Frida to inspect Objective-C or Swift methods, Keychain access, SSL pinning, and URL schemes for CTF challenges. Correlates static evidence with live hook output to reproduce accepted request paths.
12.8k · bundle
shulkwisec ssrf
Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.
21
More results
kensaurus audit-db-schema
Audit database schema for consistency, validation, and industry standards. Use when reviewing schema design, naming conventions, constraints, indexes, or migrations. Destructive-op gates → plan-data-integrity. Who-can-read-what RLS → plan-rls-audit. Restore/RPO → plan-backup-dr.
8 · bundle
saranskumar firestore-schema-designer
Use when a Firebase app needs Firestore collection design, document shape, subcollection strategy, security rule implications, or query-aware data modeling. Trigger on requests to design Firestore data structures before implementation.
0 · bundle
mukul975 exploiting-deeplink-vulnerabilities
Tests and exploits deep link vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation.
24.6k · bundle
shulkwisec oauth-security
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht
21