Hack Skills

HackSkills: Master Router for Security Testing

Master entry router for HackSkills — a curated knowledge base of 101 offensive security skills covering web, API, auth, injection, file access, business logic, infrastructure, OS privilege escalation, Active Directory, mobile, binary exploitation, reverse engineering, cryptography, blockchain, AI/ML security, and forensics.

Built for bug bounty, penetration testing, CTF competitions, and authorized security research.

Anti-Rationalization Table

When to Use

Use when:

• Starting a new bug bounty target or penetration test engagement
• Deciding whether to load XSS / SQLi / SSRF / IDOR / JWT / API tracks first
• Routing scattered findings to the correct attack surface skill
• Wanting AI to miss fewer critical test points in security work
• Needing a structured methodology instead of random payload enumeration

Don't use for:

• Unauthorized testing (use only on authorized targets, bug bounty programs, defensive validation)
• Deep exploitation details (drill into category/deep topic skills after routing)

Operating Model: The HackSkills Router

Phase 1: Recon & Context Validation (Always First)

Collect before testing:

• Target type: classic web, REST API, mobile backend, admin panel, payment flow, file upload, GraphQL
• Identity/permission model: anonymous, regular user, admin, multi-tenant
• Input locations: URL, query params, JSON, headers, cookies, filenames, imported files, templates, reflection points
• Output locations: HTML, attributes, JS, PDF, email, logs, background tasks, mobile endpoints

Phase 2: Route by Observed Behavior

Phase 3: Testing Priority Order

1. Recon / Methodology — recon-for-sec → recon-and-methodology
2. API Security / Auth / IDOR — api-sec → api-authorization-and-bola, api-auth-and-jwt-abuse, idor-broken-object-authorization
3. Injection Core — injection-checking → xss-cross-site-scripting, sqli-sql-injection, ssrf-server-side-request-forgery, ssti-server-side-template-injection, xxe-xml-external-entity
4. Business Logic / Race — business-logic-vuln → business-logic-vulnerabilities, race-condition
5. Chained Exploits / PrivEsc — OS/AD/container/mobile skills based on target

Workflow

1. Install — npx skills add yaklang/hack-skills or clone the repo
2. Start with Recon — Load recon-for-sec to map assets, tech stack, endpoints
3. Route by Signal — Use the Phase 2 table to select category skill(s)
4. Drill Deep — Load specific deep topic skill(s) for exploit details
5. Chain & Escalate — Combine findings across categories for max impact
6. Report — Document findings with reproduction steps, impact, remediation

Core Skill Map (101 Deep Topic Skills)

Reconnaissance & Methodology

• recon-and-methodology — Methodology framework, Java middleware fingerprint matrix, leak detection checklist
• insecure-source-code-management — .git/.svn/.hg/.bzr recovery, backup file patterns
• dependency-confusion — npm/pip/gem hijacking, manifest identification

API Security

• api-recon-and-docs — API discovery, OpenAPI/Swagger, hidden endpoints
• api-authorization-and-bola — BOLA/BFLA, mass assignment, object-level authz
• api-auth-and-jwt-abuse — JWT attacks, API key abuse, token manipulation
• graphql-and-hidden-parameters — GraphQL introspection, batching, hidden params

Authentication & Authorization

• authbypass-authentication-flaws — Password reset 22-pattern matrix, captcha bypass 20 methods, insecure randomness
• jwt-oauth-token-attacks — JWT alg confusion, key confusion, claim tampering, JWKS abuse
• oauth-oidc-misconfiguration — OAuth flow hijacking, OIDC misconfiguration
• saml-sso-assertion-attacks — SAML assertion manipulation, SSO bypass
• idor-broken-object-authorization — 8-category IDOR testing, ORM filter chain leaks (Django/Prisma/Ransack)

Injection Attacks

• xss-cross-site-scripting — Polyglot payloads, WAF bypass by vendor, CSP bypass, DOM clobbering, CSS injection
• sqli-sql-injection — DB2/Cassandra/BigQuery/SQLite specifics, SQLite RCE, WAF bypass matrix
• ssrf-server-side-request-forgery — Cloud metadata 6-platform matrix, DNS rebinding, Gopher/Redis RCE chain
• ssti-server-side-template-injection — 15+ engine coverage, blind SSTI, Flask PIN calculation
• cmdi-command-injection — WAF bypass, PHP disable_functions 6 bypass paths, component RCE
• nosql-injection — Blind extraction scripts, aggregation pipeline injection, $where JS execution
• xxe-xml-external-entity — Local DTD injection (17+ paths), blind XXE, OOB exfiltration
• deserialization-insecure — Java/PHP/Python/.NET/Node.js chains
• prototype-pollution — Express black-box probing, EJS/Kibana gadget chains
• type-juggling — PHP loose comparison, magic hash, HMAC 0e brute-force
• http-parameter-pollution — Server behavior matrix (9 platforms), HPP+WAF bypass
• xslt-injection — 3 RCE chains (PHP/Java/.NET), EXSLT file write
• csv-formula-injection — DDE/rundll32, Google Sheets IMPORT* exfiltration
• expression-language-injection — SpEL, OGNL, Java EL injection with RCE
• jndi-injection — JNDI/LDAP/RMI, Log4Shell patterns
• crlf-injection — Header injection, HTTP response splitting
• request-smuggling — CL.TE/TE.CL/TE.TE, HTTP/2 downgrade, client-side desync
• ghost-bits-cast-attack — Java char-to-byte narrowing WAF bypass (Black Hat Asia 2026)

File & Path Attacks

• path-traversal-lfi — LFI-to-RCE 7 paths, PHP wrapper matrix, pearcmd 4 methods
• upload-insecure-files — Success rate formula, editor path matrix, validation defect taxonomy

Business Logic & Session

• business-logic-vulnerabilities — Payment manipulation matrix (10 attacks), state machine bypass
• race-condition — TOCTOU, HTTP/1.1 last-byte sync, HTTP/2 single-packet, Turbo Intruder templates
• csrf-cross-site-request-forgery — JSON CSRF, multipart upload CSRF, CSPT2CSRF
• clickjacking — Frame-based attacks, X-Frame-Options/CSP bypass
• cors-cross-origin-misconfiguration — Origin reflection, null origin, subdomain trust
• open-redirect — Redirect chain abuse, tabnabbing
• web-cache-deception — Path confusion, cache key manipulation

Advanced Web Security

• subdomain-takeover — Dangling DNS, cloud fingerprinting, verification bypass
• waf-bypass-techniques — Encoding chains, chunked transfer, vendor-specific matrices
• csp-bypass-advanced — Script gadgets, base-uri abuse, JSONP, trusted CDN, strict-dynamic
• http-host-header-attacks — Password reset poisoning, cache poisoning, routing SSRF
• dangling-markup-injection — HTML injection without JS, CSP-safe data theft
• dns-rebinding-attacks — Internal network access, TTL manipulation, SOP bypass
• email-header-injection — SMTP header injection, phishing via injected headers
• http2-specific-attacks — H2 smuggling, HPACK attacks, stream multiplexing abuse
• prototype-pollution-advanced — Server-side gadget chains, framework-specific PP→RCE
• 401-403-bypass-techniques — Path normalization, verb tampering, header-based bypass

Infrastructure & Network

• unauthorized-access-common-services — Reverse proxy misconfig, service exposure
• insecure-source-code-management — VCS recovery, backup file patterns
• dependency-confusion — Supply chain hijacking, scope/namespace defense
• websocket-security — CSWSH, Origin validation, wsrepl tooling
• network-protocol-attacks — ARP/DNS/LLNMR/DHCP/IPv6 poisoning
• tunneling-and-pivoting — SSH tunnels, chisel/ligolo-ng, DNS/ICMP tunneling
• reverse-shell-techniques — Multi-language shells, encrypted, staged/stageless

Linux & Container Security

• linux-privilege-escalation — SUID/SGID, kernel exploits, sudo, cron, capabilities, NFS
• container-escape-techniques — Docker socket, privileged escape, cgroup breakout, runc vulns
• linux-security-bypass — SELinux/AppArmor/seccomp/namespace/LD_PRELOAD
• linux-lateral-movement — SSH keys, credential reuse, NFS/cron persistence
• kubernetes-pentesting — PSP bypass, RBAC abuse, SA token theft, etcd, kubelet API

Windows & Active Directory

• windows-privilege-escalation — Token manipulation, service misconfig, DLL hijack, UAC, Potato
• active-directory-kerberos-attacks — Kerberoast, AS-REP roast, Golden/Silver Ticket, delegation
• active-directory-acl-abuse — DCSync, WriteDACL/GenericAll, BloodHound
• active-directory-certificate-services — ESC1–ESC8, Shadow Credentials, CA persistence
• ntlm-relay-coercion — PetitPotam, PrinterBug, relay chains, WebDAV
• windows-lateral-movement — PsExec, WMI, WinRM, DCOM, PtH/PtT, RDP hijacking
• windows-av-evasion — AMSI bypass, ETW patching, API unhooking, LOLBins, obfuscation

macOS Security

• macos-security-bypass — Gatekeeper, TCC, SIP, LaunchAgent, quarantine
• macos-process-injection — Dylib injection, task_for_pid, XPC, Electron injection

Mobile Security

• android-pentesting-tricks — APK analysis, Frida, Intent, root detection, WebView
• ios-pentesting-tricks — IPA analysis, ObjC runtime, jailbreak bypass, Keychain
• mobile-ssl-pinning-bypass — Frida/Objection scripts, network security config

Binary Exploitation (Pwn)

• stack-overflow-and-rop — Buffer overflow, ROP, ret2libc, SROP, stack pivoting
• heap-exploitation — UAF, double free, tcache poisoning, fastbin, House of series
• format-string-exploitation — Read/write primitives, GOT overwrite, FORTIFY bypass
• kernel-exploitation — Kernel ROP, ret2usr, SMEP/SMAP/KPTI bypass, modprobe_path
• browser-exploitation-v8 — V8 JIT bugs, type confusion, OOB, sandbox escape
• sandbox-escape-techniques — Browser sandbox, seccomp, IPC, kernel for sandbox breakout
• binary-protection-bypass — ASLR/NX/PIE/Canary/RELRO bypass, info leak exploitation
• arbitrary-write-to-rce — GOT/__free_hook, FSOP, _IO_FILE, exit handler

Reverse Engineering

• anti-debugging-techniques — ptrace, timing, self-modifying, anti-VM, exception-based
• code-obfuscation-deobfuscation — Control flow flattening, opaque predicates, OLLVM/Themida/VMProtect
• symbolic-execution-tools — angr, Z3, Triton for vuln discovery, constraint solving
• vm-and-bytecode-reverse — Custom VM/bytecode, Python/Java/.NET decompilation

Cryptography Attacks

• rsa-attack-techniques — Wiener, Boneh-Durfee, Hastad, Coppersmith, padding oracle
• symmetric-cipher-attacks — Padding oracle, bit-flipping, ECB cut-paste, MITM
• lattice-crypto-attacks — LLL/BKZ, Hidden Number Problem, NTRU, CVP/SVP
• hash-attack-techniques — Length extension, birthday, collision, bcrypt/scrypt/argon2
• classical-cipher-analysis — Frequency analysis, Vigenère/Kasiski, Hill, Enigma

Blockchain & Smart Contract

• smart-contract-vulnerabilities — Reentrancy (4), integer overflow, delegatecall, flash loan
• defi-attack-patterns — Flash loan oracle manipulation, MEV sandwich, governance, bridge

AI/ML & LLM Security

• llm-prompt-injection — Direct/indirect injection, RAG poisoning, tool abuse, MCP risks
• ai-ml-security — Pickle RCE, adversarial examples, data poisoning, model extraction

Forensics & Steganography

• memory-forensics-volatility — Volatility framework, process/network analysis, malware
• steganography-techniques — LSB, format analysis, zsteg/stegsolve/steghide, EXIF
• traffic-analysis-pcap — Wireshark/tshark, protocol dissection, stream reconstruction

High-Value Expert Intuitions

1. Same filter reused across pages — if one bypassable, similar pages usually are too
2. Parameter names are attack surface — WAFs often inspect values, not names
3. Second-order vulns are common — safe at storage ≠ safe when later read dangerously
4. BOLA = authenticated but unauthorized — replay with account A/B switching critical
5. Older API versions miss patches — fixing v2 doesn't mean v1 retired
6. Business logic = highest impact — scanners miss them, persist longer
7. Race conditions → one-time actions — coupons, claims, resets, invites, inventory
8. JWT: check key/algorithm context first — verify alg, kid, JWKS, key source before spraying

Suggested Prompts

• "Plan the testing route for this target using bug bounty methodology"
• "This is a REST API; prioritize BOLA, BFLA, Mass Assignment, and JWT angles"
• "This parameter triggers server-side requests; list key validation points from SSRF perspective"
• "This feature is a payment/coupon/inventory flow; prioritize business logic and race-condition analysis"
• "I only see login and password-reset flows; analyze via Auth Bypass + OAuth/JWT + CSRF"

Installation

# Via npx (preferred)
npx skills add yaklang/hack-skills

# Or raw URL
curl -fsSL https://raw.githubusercontent.com/yaklang/hack-skills/main/skills-hack/SKILL.md

# Offline ZIP (AES-256, password: hack-skills)
curl -fsSLO https://oss-qn.yaklang.com/hack-skills/latest/hack-skills.zip
7z x -phack-skills hack-skills.zip

Verification Checklist

• Target type and identity model identified before testing
• Recon completed: asset discovery, tech fingerprinting, endpoint inventory
• Routing decision documented with observed signals
• Category skill loaded for each identified attack surface
• Testing follows priority order: Recon → API/Auth/IDOR → Injection → Business Logic → Chain
• Business logic and race conditions tested (not just scanner output)
• JWT/auth attacks verify key/algorithm context before payload spraying
• Findings chained across categories where applicable
• All testing within authorized scope only

References

• Source Repository: https://github.com/yaklang/hack-skills
• Web UI: https://skills.hackbenchmark.com (search, filter, copy install commands)
• Offline ZIP: https://oss-qn.yaklang.com/hack-skills/latest/hack-skills.zip (password: hack-skills)
• Primary Sources: PayloadsAllTheThings, PentesterSpecialDict, Dictionary-Of-Pentesting, Hello-CTF, ctf-wiki, hacktricks, public CVE advisories
• Sister Projects: Yak Skills (yaklang/yak-skills), Training Materials (yaklang/yaklang-ai-training-materials), Benchmark (hackbenchmark.com)