NoorQureshi
- 160 skills
- 0 followers
- 1 day ago last updated
- ▌ Recon Github Code Leaks · noorqureshiFind secrets and internal detail an organisation leaked to public code — GitHub/GitLab repos, gists, and commit history. Load during recon of a named org, on "github dorks", "leaked secrets", "find API keys", or when employees/repos are in scope. Signals: a company GitHub org, developer usernames, an internal domain to grep for.
- ▌ Web Auth Session Handling · noorqureshiLegitimately acquire and KEEP an authenticated session (through MFA/OTP) so you can test the post-auth attack surface, and hand that session to your tools without leaking secrets. Load when the high-value classes (IDOR/BOLA, mass assignment, injection on real data APIs) are blocked behind login/SMS-OTP/TOTP, when tokens keep expiring mid-test, or when Burp/Playwright keep logging you out. Distinct from attacking auth — this one authenticates and reuses the session.
- ▌ Web Python Sandbox Escape · noorqureshiEscape a Python sandbox / eval jail to reach code execution — defeat keyword blocklists and restricted eval/exec by reaching objects through the class hierarchy. Load when user input hits eval/exec/a "safe" expression evaluator, a Python REPL/calculator feature, a template that runs Python, or a filtered code box. Signals: "eval", "exec", `__import__` blocked, banned words (import/os/system), a Python jail, PyYAML/pickle input, a formula/expression field.
- ▌ Web Ssrf Gopher Redis Rce · noorqureshiTurn a server-side request (SSRF) into RCE by speaking the Redis protocol over gopher:// to an internal, unauthenticated Redis — write a cron job, an SSH key, or a webshell. Load when: SSRF is confirmed (URL fetch, webhook, PDF/URL preview, image proxy) AND an internal Redis/6379 (or similar line-protocol service) is reachable. Authorized targets only.
- ▌ API Mongo Agg Facet Bypass · noorqureshiBypass a MongoDB aggregation-pipeline stage allowlist by nesting disallowed read stages inside $facet, then $unionWith/$lookup sibling collections to exfiltrate secrets (invite tokens, creds, hashes). Load when: an endpoint accepts a user-supplied `pipeline` (or errors like "operator-form queries not accepted, use the pipeline parameter"), a Node/Express + MongoDB backend, 24-hex `_id`s, or an "advanced query" API. Authorized targets only.
- ▌ Code Review Dotnet · noorqureshiSecurity review of .NET / C# code — dangerous sinks and ASP.NET pitfalls. Load when reviewing a C#/.NET codebase/PR, on .cs source in scope, or "review this .NET app". Signals: .csproj/.sln, ASP.NET (Core/MVC/WebForms), BinaryFormatter, SqlCommand, Razor Html.Raw, XmlDocument.
- ▌ Code Review Nodejs · noorqureshiSecurity review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
- ▌ Code Review Python · noorqureshiSecurity review of Python code — dangerous sinks and framework-specific pitfalls (Django/Flask/ FastAPI). Load when reviewing a Python codebase/PR, on .py source in scope, or "review this Python". Signals: requirements.txt/pyproject, Django/Flask/FastAPI, ORMs, pickle/yaml, subprocess.
- ▌ Defense Malware Triage · noorqureshiSafely triage a suspicious file or process — is it malicious, what does it do, and what IOCs does it yield — with static then dynamic analysis. Load for "is this file malware", "analyze this binary/script/document", "suspicious process on a host", or extracting IOCs for hunting/detection.
- ▌ Defense Threat Hunting · noorqureshiHunt for intrusions no alert fired on — hypothesis-driven, ATT&CK-guided searching across EDR and logs. Load for "threat hunt", "are we compromised", "hunt for <technique>", proactive blue-team work, or turning threat intel into a hunt. Complements detection engineering: hunts find the gaps, then become detections.
- ▌ Privesc Linux Gtfobins · noorqureshiLinux privilege escalation via sudo rules, SUID/SGID binaries, and capabilities using GTFOBins techniques. Load with a Linux shell needing root, on `sudo -l` output, SUID/`getcap` findings, or "escalate on Linux". Signals: allowed sudo commands, SUID binaries, file capabilities, cron/PATH abuse.
- ▌ Privesc Windows Tokens · noorqureshiWindows privilege escalation via token impersonation privileges — SeImpersonate/SeAssignPrimaryToken (the Potato family) and related token abuse to SYSTEM. Load with a Windows shell as a service/web account, on "SeImpersonate", "whoami /priv", IIS/MSSQL service context, or "got a shell on Windows".
- ▌ Social Eng Phishing · noorqureshiRun an authorized phishing / spear-phishing assessment that measures human-factor risk — pretext, delivery, landing page, and tracking — without harming staff or hoarding real data. Load after social-eng-methodology when the objective is email-based (click, credential submission, or report rate). Signals: "phishing test", "simulated phishing", "test click rate", "credential harvesting assessment", awareness-campaign objective.
- ▌ Social Eng Physical · noorqureshiRun an authorized physical social-engineering assessment — tailgating, pretext entry, badge/RFID cloning checks, and media-drop tests — to measure physical and human access controls safely. Load after social-eng-methodology when the objective is on-site. Signals: "physical pentest", "test our building access", "tailgating", "badge cloning", "USB drop", "can we get into the office/data center". Requires a carried authorization letter.
- ▌ Wireless Wpa2 Attacks · noorqureshiAttack WPA2-PSK Wi-Fi end to end — monitor mode, network discovery, handshake/PMKID capture, and offline cracking. Load on an authorized wireless engagement with a WPA2-personal network in scope. Signals: an SSID/BSSID to test, a wireless adapter in monitor mode, a captured .pcap/.22000, "crack the Wi-Fi", "capture the handshake", aircrack-ng/hcxdumptool in play.
- ▌ Crypto Rsa Attacks · noorqureshiBreak RSA when parameters or padding are weak — recover plaintext or the private key from a public key and ciphertext. Load when you meet RSA in auth/tokens/TLS/custom crypto and have (n, e) + a ciphertext. Signals: a public key or n/e/c values, small exponent e=3, "textbook RSA", a JWT signed RS256 with a suspicious key, RsaCtfTool, factordb, close/shared primes, key you can't verify.
- ▌ Defense Cloud Detection · noorqureshiDetect and respond to attacks in cloud control planes — credential abuse, IMDS theft, persistence, and privilege escalation — from audit logs. Load for "detect cloud attacks", "CloudTrail/GuardDuty", "someone used our keys", AWS/Azure/GCP monitoring, or cloud IR. The defensive counterpart to the cloud-* offensive skills.
- ▌ Defense Detection Sigma · noorqureshiWrite portable detections as Sigma rules and map them to MITRE ATT&CK, then convert to your SIEM. Load for blue-team/detection-engineering tasks: "write a detection", "sigma rule", "alert on", turning an offensive technique or an incident into a repeatable detection.
- ▌ Defense Threat Modeling · noorqureshiThreat-model a system or feature (STRIDE + attack trees) to find design-level risk before code. Load on "threat model", a new design/architecture review, security design questions, or planning controls. Signals: architecture diagram, data-flow, "what could go wrong", pre-build security.
- ▌ Network Service Attacks · noorqureshiAttack non-web network services surfaced by recon. Load when nmap shows services like SMB (445), RPC (135), LDAP (389), SNMP (161), NFS (2049), SMTP (25), FTP (21), RDP (3389), databases (3306/5432/1433/6379/27017). Signals: open non-HTTP ports, service+version banners.
- ▌ Payloads Xss Polyglots · noorqureshiContext-breaking XSS polyglots and per-context payloads that fire across HTML/attribute/JS/ URL sinks in one shot. Load when confirming XSS fast, unsure of the injection context, or a single test payload should cover many contexts. Signals: reflected input, XSS triage, "polyglot".
- ▌ Tradecraft Scope Roe · noorqureshiEstablish and enforce the authorization envelope before any testing — the scope rule that governs everything. Load FIRST on every engagement, on "start", a new target, a program handle, or any ambiguity about what is allowed. Signals: a domain/IP to test, a bug-bounty program handle, a pentest statement of work, a scope list.
- ▌ Code Review Solidity · noorqureshiSecurity review of Solidity / EVM smart contracts — reentrancy, access control, arithmetic, and DeFi economic bugs. Load when reviewing a smart contract / web3 codebase or PR, on .sol source in scope, or "audit this contract". Signals: *.sol, foundry/hardhat, ERC-20/721, external calls, delegatecall, proxy patterns, price oracles.
- ▌ Mobile Android Assessment · noorqureshiAssess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.
- ▌ Payloads File Transfers · noorqureshiMove files on/off a target when there's no shared drive — upload tools (linpeas, nc, exploits), pull loot back, and do it through a pivot or when wget/curl are missing. Load when you need to get a file to or from an authorized host. Signals: "transfer a file", "upload linpeas", "no wget/curl", "get the file off the box", certutil/bitsadmin/impacket-smbserver, exfil over a tunnel.
- ▌ Payloads Reverse Shells · noorqureshiGet a reliable reverse (or bind) shell and upgrade it to a real interactive TTY. Load the moment you have code execution and need a shell back — RCE confirmed, a command-injection sink, an upload that runs, a webshell, a cron/service you control. Signals: "reverse shell", "get a shell", "nc listener", "shell is dumb / no tab completion", "which payload", stabilize/upgrade a shell.
- ▌ Reporting Cvss Scoring · noorqureshiAssign a defensible severity to a finding — build the CVSS 3.1 vector from demonstrated impact and reconcile it with the program's own scale. Load on "what severity", "CVSS", "rate this bug", or before submitting a report. Signals: a confirmed finding needing a score, a program VRT/severity policy, a severity dispute.
- ▌ Web HTTP Parameter Pollution · noorqureshiSend the same parameter more than once so the WAF/validator and the backend disagree on which value wins — bypassing filters, access control, or business logic. Load on "HPP", when a value is validated at one layer but used at another, or when a WAF blocks a payload you need to slip past. Signals: proxies/gateways in front of the app, duplicated params reflected inconsistently.
- ▌ AI Insecure Output Handling · noorqureshiExploit apps that trust LLM output — pass model text unsanitized into XSS sinks, SQL, shell, code, or downstream calls. Load when LLM output is rendered as HTML/markdown, executed, or fed to another system. Signals: chatbot output shown with innerHTML/dangerouslySetInnerHTML, "run this code", LLM-generated queries/commands, agent output used in eval/exec.
- ▌ Defense Incident Response · noorqureshiRun an incident end to end — detect, scope, contain, eradicate, recover, learn. Load for "we've been breached", "incident response", "contain this host", "we found malware/an intrusion", or to build an IR plan. Complements defense-dfir-triage (evidence collection) with the response process around it.
- ▌ Defense Network Detection · noorqureshiDetect attacker activity in network telemetry — C2 beaconing, DNS tunnelling, data exfil, and lateral movement. Load for "detect C2", "find beaconing", "network monitoring / NSM", "suspicious traffic", or building Zeek/Suricata coverage. The defensive counterpart to the offensive network/pivoting skills.
- ▌ Mobile Cert Pinning Bypass · noorqureshiBypass TLS certificate pinning so you can proxy a mobile app's traffic. Load when a proxy shows no/broken traffic, you see SSL handshake failures in logs, OkHttp CertificatePinner, TrustKit, or "the app won't connect through Burp". Android/iOS.
- ▌ Network Appliance Attacks · noorqureshiOffensively test perimeter appliances and VPN crypto — IKE/IPsec aggressive mode, transform/DH enumeration, safe firmware/version inference for FortiGate / PAN-OS / Cisco ASA / Citrix feeding CVE applicability, TLS-version posture, and NTLM Type-2 info leaks. Load when an edge firewall, VPN, or load balancer is in scope. Signals: UDP 500/4500, ports 4433/10443/443 on an appliance, "SSL-VPN"/"Global Protect"/"Pulse"/"NetScaler" banners, Check Point SIC (18190/18191).
- ▌ Network Password Spraying · noorqureshiLow-and-slow credential attacks against exposed auth surfaces — spray one password across many users, and stuff known breach creds — without locking accounts. Load on a login portal or service auth with valid usernames: OWA/O365/Entra, VPN, Citrix, SSH, RDP, SMB, LDAP, or a web login. Signals: a harvested user list, "AzureAD"/"outlook", 401/403 on auth, lockout policy known.
- ▌ Social Eng Methodology · noorqureshiPlan and run an AUTHORIZED social-engineering assessment safely — the load-first guardrails for any human-factor test. Load before any phishing, vishing, pretext, or physical work. Signals: "social engineering", "phishing assessment", "test our employees", "security awareness", a human-factor objective in a pentest SoW. Establishes authorization, safety, tracking, and the awareness-focused report.
- ▌ Crypto Oracle Attacks · noorqureshiBreak weak symmetric crypto in real apps — decrypt or forge encrypted tokens/cookies without the key via padding oracles (CBC), ECB block shuffling, and hash-length-extension of homemade MACs. Load when the app hands you ciphertext you can tamper with and resend: an encrypted cookie/token, a "state"/"data" blob, an IV+ciphertext, a `H(secret‖msg)` signature, base64 that changes on edit.
- ▌ Defense Hardening Baseline · noorqureshiTurn offensive findings into concrete hardening — the fix side of each vuln class, plus config baselines. Load for blue-team/remediation tasks, "how do we fix/prevent", secure config review, or writing the remediation section of a report. Signals: "harden", "remediation", "secure baseline", "prevent".
- ▌ Network Pivoting Tunneling · noorqureshiPivot into internal networks from a foothold — tunnels, port-forwards, and proxychains. Load when a host has a second NIC / reaches an internal subnet you can't hit directly, on "pivot", "internal network", "double-hop", after a foothold in a multi-host lab.
- ▌ Reporting Pentest Report · noorqureshiStructure a professional penetration-test report (engagement deliverable, not a single bug). Load at the end of a pentest, on "write the pentest report", "executive summary", "deliverable", or compiling findings for a client. Signals: engagement wrap-up, multiple findings, client report.
- ▌ Web Client Side Signing Bypass · noorqureshiReverse client-side request signing / obfuscated JS so you can replay and fuzz a protected API outside the browser. Load when requests carry a computed guard you must reproduce: an X-Signature / X-Sign / sign / hmac / _s / token header or body field, a nonce+timestamp, a "signature invalid" 401, encrypted request bodies, or minified/webpack/WASM/JSVMP signer code.
- ▌ Code Review Methodology · noorqureshiSystematic manual source-code security review — how to find bugs by reading code. Load on "review this code/repo", a source-available target, whitebox testing, or auditing a PR/app for vulnerabilities. Signals: a codebase in scope, "SAST", "secure code review", a language repo.
- ▌ Exploit Poc Development · noorqureshiTurn a known/1-day vulnerability or a raw bug into a working, reliable PoC for an authorized target. Load when a CVE/advisory needs weaponizing, a public PoC needs adapting, or "write an exploit/PoC". Signals: a versioned service with a known CVE, a crash/primitive to develop, searchsploit hits.
- ▌ Network Credential Cracking · noorqureshiCrack hashes and handshakes captured during an engagement — identify the format, pick the right hashcat/john mode, and run wordlist + rules. Load when you've recovered a hash, ticket, or handshake and need the plaintext. Signals: bcrypt $2b$/PBKDF2/sha512crypt $6$, NTLM/NetNTLMv2, Kerberos $krb5tgs$/$krb5asrep$, WPA2 .22000, a leaked DB hash column, "what hashcat mode".
- ▌ Automation Recon Pipeline · noorqureshiChain recon tools into a repeatable, resumable pipeline for continuous bug-bounty coverage. Load on "automate recon", "recon pipeline", monitoring many programs, or scaling subdomain→ live→scan. Signals: wildcard scope at scale, wanting scheduled/continuous discovery.
- ▌ Recon Techstack Fingerprinting · noorqureshiPassively identify a target's full technology stack — frontend framework, backend runtime, server, CMS, CDN/WAF, cloud, and versions — from public signals, then route to the right attack skills and CVEs. Load at the start of a web/API assessment, when choosing which techniques apply, or when "what is this built with / what CVEs match". Signals: a new domain in scope, unknown stack, "fingerprint", "what framework", version-to-CVE matching.
- ▌ Defense Detection Engineering · noorqureshiBuild detections as a repeatable pipeline, not one-off alerts. Load for "improve our detections", "detection as code", "reduce false positives", "measure ATT&CK coverage", or turning a red-team finding into durable blue-team coverage. Complements defense-detection-sigma (the rule format).
- ▌ Exploit Memory Corruption · noorqureshiTurn a memory-corruption bug in a native binary into code execution — stack overflows, format strings, and ROP against modern mitigations. Load when you control input to a compiled program and it crashes or misbehaves: a network daemon, a thick client, a setuid/SUID helper, or extracted firmware. Signals: segfault on long/`%n` input, a crash with control of a register, no source, checksec output, "exploit this binary/service".
- ▌ Reporting Triage Validation · noorqureshiValidate a finding BEFORE you write it up — kill false positives, confirm real impact, check scope, and deduplicate. Load after a candidate bug and before reporting-bug-bounty-writeup or reporting-pentest-report. Signals: "I think I found", "is this reportable", a scanner hit, a reflected value, a 500 error, an open redirect, a CORS wildcard, "should I submit this".
- ▌ Social Eng Vishing Pretext · noorqureshiRun authorized voice-phishing (vishing) and pretext-based scenarios that test whether staff and help desks follow verification procedures — safely and by consent. Load after social-eng-methodology when the objective is phone/live-interaction based (help-desk password reset, MFA-reset abuse, pretext callback). Signals: "vishing", "call the help desk", "pretext", "test our verification process", "MFA reset social engineering".
- ▌ Tradecraft Pivot Decisions · noorqureshiDecide what to do next after a result — the branching logic that turns a single outcome into the next lead. Load whenever a step just finished (success, partial, or dead end) and it's unclear where to go: "what now", "I got a shell/creds/a hash", "this didn't work", triaging which of several leads to pursue. This is the decision engine between techniques.
- ▌ Automation Nuclei Templates · noorqureshiWrite custom nuclei templates to codify a finding into a repeatable, mass-scannable check. Load on "write a nuclei template", turning a manual bug into automation, checking a CVE across many hosts, or regression-scanning. Signals: a reproducible request→match, YAML templates, nuclei.
- ▌ Reporting Bug Bounty Writeup · noorqureshiTurn a confirmed finding into a triage-friendly bug-bounty report (HackerOne/Bugcrowd) with correct severity and clean evidence. Load when a bug is validated and needs submitting, on "write the report", "CVSS", "severity", or before disclosure. Signals: a reproduced finding, a program's VRT/severity policy.
- ▌ Tradecraft Attack Scenarios · noorqureshiTurn a goal + a scope into a concrete, ordered attack scenario across multiple skills — not one technique in isolation. Load at the START of an engagement, on "where do I even begin", when a target has many surfaces, or to plan an objective-driven path (e.g. "reach domain admin", "prove data exfil"). This is how an agent decides what to try, in what order, and why.
- ▌ Tradecraft Target Selection · noorqureshiChoose where to spend effort for the best return — which program, which asset, which surface. Load at the start of bug-bounty work or when a scope is broad and time is limited, on "which program", "where should I hunt", "prioritize these targets". Signals: a big scope list, many in-scope domains, a new program, limited time.
- ▌ Code Review Dangerous Sinks · noorqureshiGrep-ready dangerous function/sink catalog per language for fast code review. Load when reviewing source in PHP, Python, JavaScript/Node, Java, Ruby, Go, .NET/C# and you need the exact functions that cause RCE/SQLi/SSRF/traversal/deserialization. Signals: "dangerous functions", "sinks", grepping a codebase.
- ▌ Web Webauthn Software Authenticator · noorqureshiRegister and authenticate against a WebAuthn/FIDO2 relying party using a self-built SOFTWARE authenticator (no hardware key) when the RP requests attestation "none" (or otherwise doesn't verify attestation trust). Load when: a login is "WebAuthn/passkey/ FIDO2", endpoints like /webauthn/register|auth/begin|finish, `navigator.credentials`, and you hold (or can leak) a registration invite/enrollment token. Authorized targets only.
- ▌ Reporting Triage Communication · noorqureshiWork productively with triagers after you submit — answer follow-ups, and handle duplicate, not-applicable, or severity disputes professionally. Load on "triage asked for more info", "they closed it as N/A", "dispute the severity/duplicate", or managing a report thread. Signals: a submitted report awaiting/receiving triage, a disagreement on outcome.
- ▌ Reverse Eng Firmware · noorqureshiExtract and analyze device firmware to find hardcoded secrets, backdoors, vulnerable services, and the real version behind an appliance. Load when you have a firmware image or can pull one. Signals: a .bin/.img firmware download, a router/IoT/appliance in scope, an OTA update file, a flash dump, "analyze this firmware", SquashFS/JFFS2/CramFS, U-Boot headers, hunting the code behind a CVE on FortiGate/Ivanti/etc.
- ▌ Code Review Secrets Detection · noorqureshiFind leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.
- ▌ Tradecraft Attack Path Mapping · noorqureshiModel the target as an attack graph — nodes (assets, identities, trust) and edges (a technique that gets you from one to the next) — and find the shortest path to the objective. Load when many findings need to be assembled into a route, on "how do these bugs connect", AD/cloud lateral- movement planning, or to explain how a foothold reaches crown jewels.