How do I install the Dos skill?

Run npx skillmds@latest add yafet-dev/dos in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dos?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

yafet-dev (@yafet-dev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dos by yafet-dev — Agent Skill

Name: Dos
Author: yafet-dev

Dos

Advanced denial-of-service testing methodology for bug bounty and application security work. Use when testing or reviewing application DoS, web cache poisoning DoS, algorithmic complexity, expensive GraphQL/API queries, large uploads, infinite loops, XMLRPC or brute-force amplification, account lockout abuse, resource exhaustion, cache-key poisoning, decompression or parser bombs, and workflows where small requests can create disproportionate CPU, memory, storage, cache, quota, or availability impact.

yafet-dev Updated Sep 21, 2026

File contents

Denial-of-Service Testing

Core Posture

Treat DoS as asymmetry: a small attacker-controlled input causes disproportionate service, user, cache, quota, or workflow disruption.

Priority Patterns

Cache poisoning: poisoned CORS, Host, language, path, query, or header variants deny service to many users.
Expensive APIs: GraphQL aliasing/depth, search, export, rendering, image conversion, reporting, and analytics.
Upload and parser stress: large payloads, archive bombs, decompression, XML, regex, SVG/PDF/image processing.
Infinite or near-infinite loops: group names, recursive relationships, callbacks, redirects, and state machines.
Account or tenant disruption: SSO DoS, account lockout, MFA lockout, organization-wide auth disruption.
Rate-limit gaps: XMLRPC, basic auth, OTP, login, WebDAV, and old endpoints.

Assessment Loop

Identify attacker-controlled inputs that reach expensive code, cache keys, parsers, or shared state.
Estimate amplification: per-request CPU, memory, storage, cache spread, fan-out jobs, third-party quota, or victim count.
Prefer low-volume proofs: timing deltas, single-object disruption, controlled cache entry, bounded query cost, or disposable tenant.
Test variants: size, depth, alias count, repeated IDs, recursion, malformed values, cache headers, and concurrent requests.
Confirm reversible impact without broad disruption.

High-Value Cues

Family	Ask
Cache DoS	Can one poisoned response break many users or origins?
Query cost	Can aliases/depth/search create large server work?
Parser stress	Can one file/body trigger high CPU, memory, or disk?
Workflow loops	Can a state create repeated jobs, emails, or callbacks?
Auth lockout	Can A lock out B or an entire org?
Quota/cost	Can a public key or API burn paid quota?

Variant Playbook

Increase size, nesting, aliases, repeated fields, page size, export range, and filter complexity gradually.
Test cache key confusion with Host, Origin, Accept-Language, path, query, cookies, and authorization headers.
Try compressed payloads, multipart files, archives, SVG/XML/PDF/images, and malformed parser inputs.
Race or repeat actions that schedule jobs or notifications.
Compare rate limits by IP, account, token, tenant, endpoint, and client type.

Confirmation Discipline

Strong evidence shows measurable resource impact, victim impact, shared-cache poisoning, account/org lockout, or expensive quota burn from bounded requests. Avoid broad destructive testing.

References

Read references/advanced-methodology.md only when the task needs deeper cache, GraphQL, parser, upload, lockout, rate-limit, confirmation, or remediation checks.

---name: dosdescription: Advanced denial-of-service testing methodology for bug bounty and application security work. Use when testing or reviewing application DoS, web cache poisoning DoS, algorithmic complexity, expensive GraphQL/API queries, large uploads, infinite loops, XMLRPC or brute-force amplification, account lockout abuse, resource exhaustion, cache-key poisoning, decompression or parser bombs, and workflows where small requests can create disproportionate CPU, memory, storage, cache, quota, or availability impact.---# Denial-of-Service Testing## Core PostureTreat DoS as asymmetry: a small attacker-controlled input causes disproportionate service, user, cache, quota, or workflow disruption.## Priority Patterns- Cache poisoning: poisoned CORS, Host, language, path, query, or header variants deny service to many users.- Expensive APIs: GraphQL aliasing/depth, search, export, rendering, image conversion, reporting, and analytics.- Upload and parser stress: large payloads, archive bombs, decompression, XML, regex, SVG/PDF/image processing.- Infinite or near-infinite loops: group names, recursive relationships, callbacks, redirects, and state machines.- Account or tenant disruption: SSO DoS, account lockout, MFA lockout, organization-wide auth disruption.- Rate-limit gaps: XMLRPC, basic auth, OTP, login, WebDAV, and old endpoints.## Assessment Loop1. Identify attacker-controlled inputs that reach expensive code, cache keys, parsers, or shared state.2. Estimate amplification: per-request CPU, memory, storage, cache spread, fan-out jobs, third-party quota, or victim count.3. Prefer low-volume proofs: timing deltas, single-object disruption, controlled cache entry, bounded query cost, or disposable tenant.4. Test variants: size, depth, alias count, repeated IDs, recursion, malformed values, cache headers, and concurrent requests.5. Confirm reversible impact without broad disruption.## High-Value Cues| Family | Ask || --- | --- || Cache DoS | Can one poisoned response break many users or origins? || Query cost | Can aliases/depth/search create large server work? || Parser stress | Can one file/body trigger high CPU, memory, or disk? || Workflow loops | Can a state create repeated jobs, emails, or callbacks? || Auth lockout | Can A lock out B or an entire org? || Quota/cost | Can a public key or API burn paid quota? |## Variant Playbook- Increase size, nesting, aliases, repeated fields, page size, export range, and filter complexity gradually.- Test cache key confusion with Host, Origin, Accept-Language, path, query, cookies, and authorization headers.- Try compressed payloads, multipart files, archives, SVG/XML/PDF/images, and malformed parser inputs.- Race or repeat actions that schedule jobs or notifications.- Compare rate limits by IP, account, token, tenant, endpoint, and client type.## Confirmation DisciplineStrong evidence shows measurable resource impact, victim impact, shared-cache poisoning, account/org lockout, or expensive quota burn from bounded requests. Avoid broad destructive testing.## ReferencesRead `references/advanced-methodology.md` only when the task needs deeper cache, GraphQL, parser, upload, lockout, rate-limit, confirmation, or remediation checks.

Frequently asked questions

Dos