netvar1337
- 736 skills
- 0 followers
- 17 hours ago last updated
- ▌ Sercanarga Engineering Style · netvar1337Use when applying Sercan Arga evidence-backed engineering style.
- ▌ Systems Language Engineering · netvar1337Use when engineering Go, Rust, C++23, Java, or Zig projects (layout, build, tests, style).
- ▌ Anti Cheat Stack Walk Stealth · netvar1337Anti-cheat stack-walking stealth: return-address spoofing, stack pivoting for call stacks, gadget frames, RtlUserThreadStart fakes, ETW/AC walk bypass.
- ▌ Assembly Reversal Engineering · netvar1337Use when writing assembly or analyzing authorized native binaries at ASM level.
- ▌ Windows Profile Hive Research · netvar1337Use when hunting Windows user-profile and registry-hive vulnerabilities involving ProfSvc, profile load/unload, CreateProcessWithLogon, RegOpenUserClassesRoot, NTUSER.DAT or UsrClass.dat, known-folder and environment expansion, offline registry editing, cross-user hive mounting, or races between profile state and attacker-controlled paths.
- ▌ Zydis Disassembly Engineering · netvar1337Use when decoding/encoding x86/x64 with Zydis in C/C++ or terminal tests.
- ▌ Development Toolchain Curation · netvar1337Use when auditing or pruning agent skills, MCPs, hooks, and language/RE toolchains.
- ▌ Enterprise Server Rce Research · netvar1337Use when hunting new remote code execution vulnerabilities in the latest stable enterprise server, appliance, middleware, management-plane, gateway, identity, backup, monitoring, messaging, database, or file-processing product. Maps unauthenticated and low-privilege network paths, builds protocol-aware harnesses, traces attacker data to native or interpreter sinks, and validates practical serve...
- ▌ LLM Jailbreak Prompt Injection · netvar1337Direct and indirect prompt injection for apps: RAG, tools, web, email, MCP schema, tool-result injection.
- ▌ Verification Before Completion · netvar1337Use before claiming work complete/fixed/passing — require verification evidence first.
- ▌ Virtualization Escape Research · netvar1337Use when hunting new guest-to-host, container-to-hypervisor, or nested-virtualization vulnerabilities in the latest stable hypervisor, emulator, cloud VM stack, virtual device, paravirtual driver/backend, guest-tools integration, management plane, snapshot/migration path, or hardware-accelerated virtualization interface.
- ▌ LLM Jailbreak Classifier Bypass · netvar1337Bypass input/output safety classifiers and staged judges (stage-1/2, keyword, embedding, reward models).
- ▌ Windows Recovery State Research · netvar1337Use when hunting Windows pre-authentication and recovery vulnerabilities involving WinRE, WinPE, BitLocker auto-unlock, Defender Offline, ReAgent.xml, BCD, unattended setup, offline servicing, recovery or EFI partitions, removable media, and persisted state that changes trusted behavior across reboot.
- ▌ Windows Object Manager Confusion · netvar1337Use when hunting Windows vulnerabilities involving NT Object Manager namespaces, per-session BaseNamedObjects, shadow directories, symbolic-link objects, named sections/events/mutants, registry symbolic links, globalroot paths, or privileged consumers that confuse attacker-created names with trusted kernel objects. Maps namespace resolution, ACLs, token transitions, and name-squatting races int...
- ▌ Binary Obfuscation Deconstruction · netvar1337Use when authorized binaries use opaque predicates, CFF, MBA, or self-modifying obfuscation.
- ▌ Windows Privileged File Workflows · netvar1337Use when researching Windows privileged file-operation vulnerabilities involving services, Defender or other security products, update/remediation pipelines, Cloud Files placeholders, VSS, reparse points, rename/delete semantics, alternate data streams, oplocks, file locks, or name-to-handle races. Builds deterministic path-confusion and file-lifecycle experiments from traces to minimized PoCs.
- ▌ Security State Machine Engineering · netvar1337Use to design/test/recover security workflows with durable state and side effects.
- ▌ Application Sandbox Escape Research · netvar1337Use when hunting new escapes from a latest-stable application sandbox or restricted process, including document readers, office suites, messaging clients, media processors, plugin hosts, renderers, security sandboxes, AppContainer, macOS Seatbelt/XPC, Linux seccomp/namespaces/portals, and brokered desktop applications. Builds a capability map, compromised-child harness, broker/IPC audit, and pr...
- ▌ Multi Repository Engineering Audits · netvar1337Use to infer an engineer style/rules from multiple repos with attribution-backed evidence.
- ▌ Mobile Platform Vulnerability Research · netvar1337Use when hunting new vulnerabilities in the latest stable Android or iOS platform and widely deployed OEM components, including zero/one-click parsers, messaging and media services, Binder/XPC IPC, application sandboxes, system services, baseband/connectivity, kernels/drivers, secure services, and mobile browser-to-OS chains.
- ▌ Security Product Vulnerability Research · netvar1337Use when hunting new vulnerabilities in the latest stable enterprise security product: endpoint protection, EDR/XDR, antivirus, DLP, firewall/VPN, email/web gateway, SIEM/SOAR, scanner, sandbox, agent, management server, update engine, parser, kernel driver, or cloud connector. Maps hostile-content pipelines and management trust boundaries to RCE, privilege escalation, bypass, or fleet-wide com...
- ▌ Industrial Control Vulnerability Research · netvar1337Use when hunting new vulnerabilities in latest stable, widely deployed SCADA/IIoT, PLC, HMI, historian, engineering workstation, OPC, industrial gateway, remote-access appliance, safety system, or device-management product. Prioritizes server-side RCE and trust-boundary flaws in management, protocol, firmware-update, project-file, and controller workflows using safe simulation and reproducible ...
- ▌
- ▌
- ▌ Plan · netvar1337Use for plan-mode only: write an actionable markdown plan under .hermes/plans/, no execution.
- ▌
- ▌ Types · netvar1337Use for IDA types: create/modify/apply structs, unions, enums, typedefs, C declarations.
- ▌
- ▌
- ▌ Connect · netvar1337Use when starting IDA analysis sessions or routing to other IDA skills (CLI/HTTP/MCP setup).
- ▌ Lang Go · netvar1337Go for tools/C2/scanners/game tooling: modules, concurrency, unsafe, Windows syscalls, performance.
- ▌ Radare2 · netvar1337Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
- ▌ Semgrep · netvar1337Use to run Semgrep security/quality scans, including multi-language parallel workers.
- ▌
- ▌ Analysis · netvar1337Use to triage/audit IDA binaries: suspicious behavior, crypto/network, multi-table queries.
- ▌ Backprop · netvar1337Use when a bug/test failure should become a new invariant and bug-log entry in SPEC.md.
- ▌ C Review · netvar1337Use when auditing C/C++ for memory corruption, integer overflow, races, and platform-specific vulns.
- ▌ Cavecrew · netvar1337Use when delegating to caveman subagents (investigator/builder/reviewer) to shrink tool-result context.
- ▌
- ▌ Gh Stack · netvar1337Use for stacked Git branches and dependent PRs via gh-stack (create, push, rebase, sync, navigate, or view).
- ▌ Graphify · netvar1337Use for codebase architecture/relationship questions; builds queryable knowledge graphs (graphify-out/).
- ▌ Grill Me · netvar1337> Bundled with Unleash skills pack. Upstream: https://github.com/JuliusBrussee/skills
- ▌ Lang Zig · netvar1337Zig for low-level cheats/tools: explicit allocators, cross-compile, C interop, freestanding options.
- ▌ Pe Tools · netvar1337PE/COFF engineering: parse, rebuild, TLS, exceptions, imports, manual map helpers, Authenticode notes.
- ▌ Research · netvar1337Use when a spec decision needs external library/API facts distilled into section R (/ck:research).
- ▌ Malware Triage · netvar1337 bundleRapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.
- ▌ Offensive Claude Reverse Engineering · netvar1337 bundleUse when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
- ▌ Router Reverse Skill Router Go Rust Reverse · netvar1337 bundleUse for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
- ▌ Threat Model Generator · netvar1337Generate feature-grounded threat scenarios and executable security test cases with prioritized risk rationale.
- ▌ Masriyan 01 Recon Osint · netvar1337 bundlePassive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
- ▌ Router Reverse Skill Router Firmware Pentest · netvar1337 bundleFirmware / IoT penetration chain. Start from a raw .bin / .img blob and run the full loop: reverse engineering → extraction → emulation → exploitation. The methodology follows the nine phases of OWASP FSTM; the toolchain centers on binwalk v3, unblob, EMBA, Firmadyne, and AFL++. Applicable scenarios: router/camera/smart-home firmware auditing, firmware upgrade package reversing, IoT CVE reproduction, embedded 0-day hunting. Trigger keywords: firmware, IoT, binwalk, unblob, UART, JTAG, squashfs, UBI, JFFS2, Firmadyne, QEMU full-system emulation, EMBA, firmware pentest, router firmware, embedded exploitation, bootloader, NVRAM, FAT, firmware analysis toolkit.
- ▌ Router Reverse Skill Router Malware Analysis · netvar1337 bundleUse when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
- ▌ Router Reverse Skill Router Protocol Reverse · netvar1337 bundleUse for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
- ▌ Binary Analysis Analyst · netvar1337Perform deep exploit-focused binary analysis by tracing attacker-reachable paths to validated vulnerability primitives.
- ▌ Web Assessment Executor · netvar1337Execute scoped web application test cases with strict sequencing, variant control, and replayable evidence.
- ▌ Claude Red Web Offensive Open Redirect · netvar1337 bundleOpen redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.
- ▌ Masriyan 09 Web Security · netvar1337 bundleOWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments
- ▌ Masriyan 12 Log Analysis · netvar1337 bundleSecurity log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
- ▌ Masriyan 14 Red Team Ops · netvar1337 bundleAuthorized red team engagement planning, C2 architecture design, attack methodology, lateral movement strategy, OPSEC, and professional reporting
- ▌ Router Reverse Skill Router Database Security · netvar1337 bundleUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
- ▌ Router Reverse Skill Router Diagram Generator · netvar1337 bundlegenerate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.
- ▌ Router Reverse Skill Router Digital Forensics · netvar1337 bundleUse for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
- ▌ Router Reverse Skill Router Hardware Security · netvar1337 bundleUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.
- ▌ Finding Chain Correlator · netvar1337Correlate individual findings into coherent multi-step attack chains with realistic prerequisites and aggregate impact.
- ▌ Claude Red Web Offensive Race Condition · netvar1337 bundleRace condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.
- ▌ Router Reverse Skill Router Browser Automation · netvar1337 bundleUnified automation entry point. Covers browser automation (Playwright) and Windows desktop application automation (OpenReverse). Browser scenarios: opening web pages, clicking, filling forms, crawling, screenshots, automated login, pentest page interaction. Desktop scenarios: operating GUI tools like IDA/x64dbg, Windows UI Automation, vision-driven interaction, desktop application traffic capture. Trigger keywords: browser automation, desktop automation, open web page, fill form, crawl, screenshot, automated login, Playwright, agent-browser, headless, OpenReverse, UIA, CUA, desktop operation, Windows automation.
- ▌ Router Reverse Skill Router Patch Diff Exploit · netvar1337 bundleN-day patch diffing through to exploitation. Infer the vulnerability from the vendor-released patch, write a PoC, and turn it into a usable attack module. Applicable scenarios: a known CVE number with a patch but no PoC, SRC/red team needing to hit assets that were not updated in time, N-day weaponization, Patch Tuesday tracking. Core method: obtain before/after binaries → align symbols → binary diff → inspect newly added security checks to infer the bug class → write a PoC to trigger the vulnerability. Trigger keywords: N-day, Nday, patch diffing, patch diff, patch tuesday, 1day, binary diff vulnerability, bindiff exploitation, ghidriff, Diaphora, patch analysis, CVE reproduction, vulnerability reconstruction, patch back-inference, N-day weaponization.
- ▌ API Attack Surface Mapper · netvar1337Build a full API inventory, trust-boundary map, and prioritized test matrix from specification and observed behavior.
- ▌ Claude Red Web Offensive Deserialization · netvar1337 bundleInsecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits.
- ▌ Detection Engineer · netvar1337Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.
- ▌ Masriyan 06 Threat Hunting · netvar1337 bundleIOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation
- ▌ Masriyan 10 Cloud Security · netvar1337 bundleAWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment
- ▌ Masriyan 19 Grc Compliance · netvar1337 bundleGovernance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation
- ▌ Router Reverse Skill Router Identity Federation · netvar1337 bundleUse for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
- ▌ Router Reverse Skill Router Reverse Engineering · netvar1337 bundleProvides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
- ▌ 401 403 Bypass · netvar1337 bundle401/403 访问拒绝绕过方法论。当遇到管理后台、API 端点返回 401/403 Forbidden 时使用。覆盖路径操纵、HTTP 方法篡改、Header 注入、协议降级、组合攻击
- ▌ Claude Red Fuzzing Offensive Vuln Classes · netvar1337 bundleExploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit dev knowledge.
- ▌ Hack Skills Expression Language Injection · netvar1337Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.
- ▌ Masriyan 11 Csoc Automation · netvar1337 bundleSOC alert triage, incident playbook automation, escalation workflows, shift reporting, and SOC KPI tracking
- ▌ Masriyan 13 Crypto Analysis · netvar1337 bundleSSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code
- ▌ Masriyan 16 AI LLM Security · netvar1337 bundleLLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments
- ▌ Masriyan 17 Mobile Security · netvar1337 bundleAndroid and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
- ▌ Masriyan 18 Ot Ics Security · netvar1337 bundleOperational Technology and industrial control system security — Purdue model segmentation, industrial protocol analysis (Modbus, DNP3, S7, EtherNet/IP), PLC/HMI exposure, IEC 62443 alignment, and MITRE ATT&CK for ICS, for authorized and safety-conscious assessments
- ▌ Javascript Surface Analyzer · netvar1337Enumerate and analyze client-side JavaScript for hidden endpoints, secrets, dangerous sinks, and exploitable browser behaviors.
- ▌ Claude Red Utility Offensive Fast Checking · netvar1337 bundleSpeed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping.
- ▌ Claude Red Web Offensive Request Smuggling · netvar1337 bundleHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.
- ▌ Masriyan 05 Malware Analysis · netvar1337 bundleStatic and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification
- ▌ Masriyan 08 Network Security · netvar1337 bundleNetwork traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection
- ▌ Router Reverse Skill Router Supply Chain Security · netvar1337 bundleUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
- ▌ Crypto Vulnerability Analyst · netvar1337Analyze cryptographic design and implementation for misuse, key-management weaknesses, and protocol-level exploit opportunities.
- ▌ Claude Red Fuzzing Offensive Fuzzing Course · netvar1337 bundleWeek 2 of the exploit development curriculum. Covers fuzzing methodology: target selection, corpus generation, coverage-guided fuzzing with AFL++/libFuzzer, structured fuzzing, and triage/deduplication. Use when setting up fuzz campaigns, selecting harness strategies, or triaging fuzzer output.
- ▌ Malware Report Writer · netvar1337 bundleCreate professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.
- ▌ Masriyan 07 Incident Response · netvar1337 bundleIR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology
- ▌ Masriyan 15 Blue Team Defense · netvar1337 bundleSystem hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement
- ▌ Claude Red Exploit Dev Offensive Mitigations · netvar1337 bundleSecurity mitigation reference and bypass catalog: ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, seccomp. Covers both detection of enabled mitigations and known bypass techniques. Use when assessing target hardening or planning exploit mitigation bypasses.
- ▌ Claude Red Recon Offensive Osint Methodology · netvar1337 bundleStructured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.
- ▌ Claude Red Web Offensive Parameter Pollution · netvar1337 bundleHTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.
- ▌ Masriyan 03 Exploit Development · netvar1337 bundleProof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
- ▌ Masriyan 04 Reverse Engineering · netvar1337 bundleBinary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
- ▌ Malware Dynamic Analysis · netvar1337 bundleExecute and monitor malware in controlled sandbox environments. Use when you need to observe runtime behavior, capture network traffic, monitor process activity, analyze file/registry changes, or understand actual malware functionality beyond static analysis. Guides safe execution with Procmon, Wireshark, Process Hacker (now System Informer), Sysmon, and automated sandboxes.