purpleailab
- 351 skills
- 0 followers
- 5 hours ago last updated
- ▌ Access Control 2 · purpleailabAuto-loaded by access-control-auditor agent during Phase 2. Provides detection patterns for: missing modifiers, privilege escalation, tx.origin phishing, OR/AND logic errors, missing two-step transfer. Core artifact: Permission Matrix.
- ▌ Economic Attack 2 · purpleailabAuto-loaded by flashloan-auditor and defi-auditor agents during Phase 2. Provides detection patterns for: spot price manipulation, oracle staleness, short TWAP, donation attacks, slippage, flash loan governance. Core artifact: Price Flow Map.
- ▌ Token 2 · purpleailabAuto-loaded by token-auditor agent during Phase 2. Provides detection patterns for: fee-on-transfer, rebasing tokens, ERC777 hooks, ERC721/1155 callbacks, missing return values, blacklist/pausable, low decimals. Core artifact: Token Compatibility Matrix.
- ▌ Oracle 2 · purpleailabAuto-loaded by oracle-auditor agent during Phase 2. Provides detection patterns for: stale prices, deprecated Chainlink functions, L2 sequencer downtime, decimal mismatches, spot price manipulation, oracle DoS. Core artifact: Oracle Integration Matrix.
- ▌ Flashloan 2 · purpleailabAuto-loaded by flashloan-auditor agent during Phase 2. Provides detection patterns for: price manipulation, governance manipulation, collateral manipulation, reward manipulation, oracle manipulation via flash loans. Core artifact: Flash Loan Attack Flow diagram.
- ▌ Reentrancy 2 · purpleailabAuto-loaded by reentrancy-auditor agent during Phase 2. Provides detection patterns for: CEI violations, cross-function/cross-contract reentrancy, read-only reentrancy, token callback exploits (ERC721/777/1155). Core artifact: State Timeline map.
- ▌ Cross Chain 2 · purpleailabAuto-loaded by cross-chain-auditor agent during Phase 2. Provides detection patterns for: missing source chain/address validation, replay attacks, message ordering, chain-specific code, finality assumptions. Core artifact: Cross-Chain Message Flow diagram.
- ▌ Logic Error 2 · purpleailabAuto-loaded by logic-auditor agent during Phase 2. Provides detection patterns for: division before multiplication, first depositor attacks, precision loss, unchecked blocks, missing slippage, edge cases. Core artifact: Calculation Flow Map.
- ▌ Osint 2 · purpleailabOpen-source intelligence gathering — email harvesting, social media profiling, breach data checking, employee enumeration, GitHub secret scanning, organizational mapping.
- ▌ Poc · purpleailab bundleGenerates and validates Foundry PoC tests from attack scenario documents. Use when: (1) Audit Phase 3 invokes Skill(vigilo:poc) for each High/Medium finding, (2) A finding at .vigilo/findings/ needs PoC validation, (3) Converting attack scenarios into executable Foundry tests. Outputs: test/poc/{finding-id}.t.sol, .vigilo/poc/ validation logs.
- ▌ Audit · purpleailab bundleSmart contract security audit orchestrator. Use when user says "audit", "security review", "find vulnerabilities", "Code4rena audit", or starts an audit workflow. Automatically executes all phases: scope → recon → analysis → PoC → report.
- ▌ Report · purpleailab bundleGenerates submission-ready audit reports from validated findings. Use when: (1) Audit Phase 4 invokes Skill(vigilo:report) after PoC validation completes, (2) Findings need to be formatted for Code4rena, Cantina, Sherlock, or Immunefi submission, (3) Generating executive summary or individual submission reports. Default format: Code4rena. Reads from .vigilo/findings/ and poc/.
- ▌ Token · purpleailabAuto-loaded by token-auditor agent during Phase 2. Provides detection patterns for: fee-on-transfer, rebasing tokens, ERC777 hooks, ERC721/1155 callbacks, missing return values, blacklist/pausable, low decimals. Core artifact: Token Compatibility Matrix.
- ▌ Oracle · purpleailabAuto-loaded by oracle-auditor agent during Phase 2. Provides detection patterns for: stale prices, deprecated Chainlink functions, L2 sequencer downtime, decimal mismatches, spot price manipulation, oracle DoS. Core artifact: Oracle Integration Matrix.
- ▌ Lending · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing lending protocols. Provides patterns for: liquidation logic, interest rate models, collateral management, health factor calculations, bad debt handling. Core vulnerabilities: self-liquidation, precision loss, oracle manipulation, collateral factor attacks.
- ▌ Staking · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing staking mechanisms. Provides patterns for: reward-per-token accumulator (Synthetix style), lock periods, multi-reward tokens, boosted staking. Critical: precision loss, first staker advantage, late staker dilution, unstake reentrancy.
- ▌ Flashloan · purpleailabAuto-loaded by flashloan-auditor agent during Phase 2. Provides detection patterns for: price manipulation, governance manipulation, collateral manipulation, reward manipulation, oracle manipulation via flash loans. Core artifact: Flash Loan Attack Flow diagram.
- ▌ Restaking · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing restaking protocols. Provides patterns for: EigenLayer AVS integration, slashing propagation, operator risks, LST/LRT depeg, withdrawal queues, cross-protocol risk amplification. Core artifact: Restaking Risk Matrix.
- ▌ Dos Attack · purpleailabAuto-loaded by logic-auditor agent during Phase 2. Provides detection patterns for: gas griefing, unbounded loops, external call failures, block gas limit exploitation, storage DoS, and liveness failures. Core artifact: Liveness Analysis Map.
- ▌ Randomness · purpleailabAuto-loaded by logic-auditor agent during Phase 2. Provides detection patterns for: block.timestamp/blockhash misuse, predictable randomness, Chainlink VRF integration, commit-reveal schemes, RANDAO on L2. Core artifact: Randomness Source Analysis.
- ▌
- ▌
- ▌ Cross Chain · purpleailabAuto-loaded by cross-chain-auditor agent during Phase 2. Provides detection patterns for: missing source chain/address validation, replay attacks, message ordering, chain-specific code, finality assumptions. Core artifact: Cross-Chain Message Flow diagram.
- ▌ Logic Error · purpleailabAuto-loaded by logic-auditor agent during Phase 2. Provides detection patterns for: division before multiplication, first depositor attacks, precision loss, unchecked blocks, missing slippage, edge cases. Core artifact: Calculation Flow Map.
- ▌ Vault Erc4626 · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing ERC4626 vaults. Provides patterns for: share/asset conversion, inflation attack mitigations, rounding direction rules, donation attacks. Critical: first depositor attack, virtual shares offset, dead shares burning.
- ▌ Upgradeability · purpleailabAuto-loaded by access-control-auditor agent during Phase 2. Provides detection patterns for: UUPS/Transparent/Beacon proxy vulnerabilities, storage collision, initialization issues, function selector clashing, upgrade authorization. Core artifact: Proxy Architecture Map.
- ▌ Economic Attack · purpleailabAuto-loaded by flashloan-auditor and defi-auditor agents during Phase 2. Provides detection patterns for: spot price manipulation, oracle staleness, short TWAP, donation attacks, slippage, flash loan governance. Core artifact: Price Flow Map.
- ▌ Vulnerability Base · purpleailabCore foundation loaded by all sub-auditor agents (reentrancy, logic, oracle, etc.). Provides: Iron Laws, Code4rena finding template, severity classification, and quality standards. Auto-loaded when sub-auditors write findings to .vigilo/findings/. Ensures consistent output format across all auditors - NO PoC code, scenario only.
- ▌ Input Validation · purpleailabAuto-loaded by logic-auditor agent during Phase 2. Provides detection patterns for: missing zero checks, address validation, array bounds, parameter constraints, calldata validation, encoding issues. Core artifact: Input Validation Matrix.
- ▌ Lending Protocol Patterns · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing lending protocols. Provides patterns for: liquidation logic, interest rate models, collateral management, health factor calculations, bad debt handling. Core vulnerabilities: self-liquidation, precision loss, oracle manipulation, collateral factor attacks.
- ▌ Staking Protocol Patterns · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing staking mechanisms. Provides patterns for: reward-per-token accumulator (Synthetix style), lock periods, multi-reward tokens, boosted staking. Critical: precision loss, first staker advantage, late staker dilution, unstake reentrancy.
- ▌ Chainlink Integration Patterns · purpleailabAuto-loaded by oracle-auditor agent during Phase 2 when Chainlink is detected. Provides patterns for: Price Feeds (stale check, decimals), VRF (front-running), CCIP (message validation), Automation/Keepers. Critical: missing staleness check, wrong decimals, sequencer down handling.
- ▌ Layerzero Integration Patterns · purpleailabAuto-loaded by cross-chain-auditor agent during Phase 2 when LayerZero is detected. Provides patterns for: OApp security (peer validation), OFT tokens (slippage), compose message validation, gas options. Critical: missing peer check, wrong peer encoding, no compose validation, insufficient executor gas.
- ▌ Lsd Token Integration Patterns · purpleailabAuto-loaded by token-auditor agent during Phase 2 when LSD tokens are detected. Provides patterns for: stETH rebasing (use shares), wstETH wrapping, rETH/cbETH exchange rates, sfrxETH (ERC4626). Critical: caching rebasing balances, 1:1 ratio assumption, 1-2 wei transfer rounding.
- ▌ Erc4626 Vault Patterns · purpleailabAuto-loaded by defi-auditor agent during Phase 2 when analyzing ERC4626 vaults. Provides patterns for: share/asset conversion, inflation attack mitigations, rounding direction rules, donation attacks. Critical: first depositor attack, virtual shares offset, dead shares burning.
- ▌ Invariant Analysis · purpleailabAuto-loaded by logic-auditor agent during Phase 2 for invariant extraction. Framework: "What conditions must ALWAYS be true? How can they be violated?" Extracts protocol invariants from code/docs, systematically explores violation paths. Types: balance, state, accounting, access invariants.
- ▌ Asset Flow Analysis · purpleailabAuto-loaded by explorator (Phase 1) and sub-auditors (Phase 2) for asset mapping. Framework: "Where's the money? How does it move? Where can it leak?" Maps asset storage locations, movement paths, leakage points. Answers attacker's first question about protocol funds.
- ▌ State Sync Analysis · purpleailabAuto-loaded by reentrancy-auditor agent during Phase 2 for state sync analysis. Framework: "When can state become inconsistent? How can that gap be exploited?" Identifies state inconsistency windows during external calls, CEI violations, read-only reentrancy, cross-contract state manipulation.
- ▌ Rmm Tool Abuse · purpleailabLegitimate RMM tool abuse — deploy or hijack Atera, ScreenConnect, AnyDesk, TeamViewer for persistence, lateral movement, and C2. Leverages trusted software to evade EDR and blend with IT admin traffic.
- ▌ Blind Sqli · purpleailabBlind SQL injection under hostile WAF — manual bypass playbook for when sqlmap fails because common tokens (SUBSTRING, IF, AND, WHERE, single quotes) are filtered. Covers token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search. Loaded on top of sqli.md when the binary oracle exists but tampers can't pass the WAF.
- ▌ Mfa Bypass · purpleailab2FA / OTP logic flaws — response & status tampering, brute force, OTP reuse, backup-code abuse, race conditions, missing-2FA on flows, remember-me bypass, password-reset skips 2FA.
- ▌ Waf Bypass · purpleailabWAF evasion — payload obfuscation, HTTP-level evasion, origin-IP discovery, rate/anomaly evasion, per-WAF notes (Cloudflare/Akamai/AWS WAF/ModSecurity).
- ▌ Xpath Xslt · purpleailabXPath + XSLT injection — query manipulation in XML data stores, server-side XSLT RCE via document() / EXSLT extensions.
- ▌ C2 Sliver · purpleailab bundleSliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.
- ▌ C2 Mythic · purpleailabMythic C2 framework operations — multi-agent (Apfell, Apollo, Athena, Poseidon, Medusa), web UI on 7443, RabbitMQ + PostgreSQL backend, JSON-RPC tasking model, building an agent via mythic-cli, profile design (HTTP/SMB/named pipe/peer-to-peer), opsec defaults. Comparison to Sliver: more pluggable, less polished UI.
- ▌ Post Exploit Reporting · purpleailabPost-exploitation finding documentation — credential access, privilege escalation, lateral movement reports, detection gap analysis, attack path documentation, CVSS v4.0 scoring.
- ▌ Deep Analysis · purpleailabDepth-first RE investigation loop for a single binary or function cluster: decompile→rename→retype→comment→re-read, with context-rot guards and on-task checks. Use when triage has already identified the interesting area and the goal is full understanding: what does function X do, identify cryptographic primitives, locate C2 protocol, recover data structures. Triggers on: 'deep analysis', 'understand function', 'recover struct', 'crypto identification', 'C2 protocol', 'reverse this binary fully', 'what does this function do'.
- ▌ Game Security Research · purpleailabAuthorized game-client, protocol, replay, and anti-tamper security research for local, self-hosted, or intentionally vulnerable training targets.
- ▌ Roe Template · purpleailab bundleRules of Engagement document creation — scope definition, prohibited/permitted actions, testing windows, escalation contacts, incident procedures.
- ▌ Turla Venomous Bear · purpleailabAdversary-emulation profile for Turla (G0010 / Venomous Bear / Secret Blizzard / Waterbug / KRYPTON / Snake), Russia's FSB Center 16 cyber-espionage actor.
- ▌ Deserialization · purpleailabHunt insecure deserialization (CWE-502) across Python pickle, Java ObjectInputStream / Jackson / SnakeYAML, .NET BinaryFormatter / DataContractJson, PHP unserialize, Ruby Marshal/YAML.load, and Node.js vm. Direct path to unauthenticated RCE.
- ▌ Ti Yara Hunting · purpleailabYARA rule writing from behavioral observations and TI report analysis — sample-to-rule conversion, condition optimization, performance tuning, and retrohunting on VirusTotal and ANY.RUN. Covers YARA/YARA-X syntax, yarGen automated generation, and production rule deployment.
- ▌ Final Report · purpleailabFinal engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.
- ▌ Enip Cip · purpleailabEtherNet/IP + CIP (TCP 44818 / UDP 2222) attack playbook — List Identity broadcast, pylogix tag-database dump, tag read/write on Allen-Bradley ControlLogix/CompactLogix, CIP Forward Open, PLC mode change (Stop/Run), and historical Rockwell auth-bypass CVEs. North American ICS dominant protocol.
- ▌ Profinet · purpleailabPROFINET (L2 EtherType 0x8892 / DCP) attack playbook — DCP Identify-All broadcast enumeration, device fingerprinting, station-name and IP reassignment (breaks IO-controller mapping), flash-LED physical location, factory-reset, RT frame injection/replay for cyclic-IO spoofing. Siemens/EU fieldbus peer of S7Comm; requires same L2 broadcast domain.
- ▌ File Upload · purpleailabArbitrary file upload exploitation — webshell upload, extension bypass, content-type manipulation, and upload-to-RCE techniques.
- ▌ Evilginx2 Proxy · purpleailabAuthor and deploy an evilginx2 phishlet to reverse-proxy a real login and capture the post-authentication session cookie, defeating MFA via session-token theft.
- ▌ Wireless Security · purpleailabWireless network security reconnaissance — WiFi analysis, Bluetooth assessment, RFID/NFC evaluation, signal capture, protocol analysis, encryption testing, rogue device detection.
- ▌ Reverser Dotnet Malware · purpleailab.NET malware analysis — dnSpy/ILSpy decompilation, de-obfuscation (ConfuserEx, .NET Reactor, Babel, Crypto Obfuscator), behavioral analysis of managed assemblies, PowerShell cradle extraction, and config decryption for common .NET RAT families.
- ▌ Reverser Malware Triage · purpleailabFast malware triage workflow — static (PE/Mach-O/ELF format, strings, imports, signatures, entropy/packed indicators), dynamic (sandbox with INetSim, Wireshark, Process Monitor, Procmon, time-shift), unpack (Scylla/PE-sieve), then full RE with Ghidra/IDA. Designed for ≤15 min initial verdict.
- ▌ Wps Pixie Dust · purpleailabWPS Pixie-Dust offline nonce attack (reaver -K / pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.
- ▌ Aatmf T08 Deception · purpleailabAATMF T8 — External Deception & Misinformation. Misinfo generation at scale, persona impersonation, document fabrication, hallucination weaponization.
- ▌ Excessive Agency · purpleailabHunt LLM excessive agency (OWASP LLM06:2025) — agentic systems granted too many tools, too broad permissions per tool, or unsupervised authority to act on the user / business behalf, producing financial loss, data loss, or destructive operations from a single bad token.
- ▌ Prompt Injection · purpleailabHunt LLM prompt injection and tool-call hijacking in modern AI-integrated applications (CWE-1427). Covers indirect injection via RAG, tool abuse, exfiltration chains, and jailbreak-to-RCE pivots on agentic systems.
- ▌ Ti Anyrun Lookup · purpleailabANY.RUN Threat Intelligence Lookup workflow — query hashes, domains, IPs, and behavioral indicators against ANY.RUN's sandbox corpus. Covers TI Lookup query syntax, search operators, free tier constraints, result correlation with engagement findings, and integration with sandbox analysis.
- ▌ GCP Org Escalation · purpleailabGCP organization-level privilege escalation — cross-project pivoting, org policy bypass, service account impersonation chains, Terraform state secrets, and GKE cluster compromise. Escalate from single-project access to org-wide control.
- ▌ Access Control · purpleailabMissing modifiers, wrong msg.sender checks, default-public functions, missing onlyOwner / onlyRole / onlyDAO authorization.
- ▌ Contracts Bridge Exploit · purpleailabCross-chain bridge attack — message-validation bypass (Wormhole class), validator key compromise (Ronin / Harmony class), reentrancy on token-bridge claim, Merkle-proof forgery on optimistic bridges, signature replay across chains. Bridges have lost >$2B; understand why.
- ▌ Orchestration · purpleailabDecepticon orchestrator patterns — delegation, state management, adaptive re-planning, context handoff protocols.
- ▌ Clickjacking · purpleailabUI redressing — missing X-Frame-Options / frame-ancestors, frame-buster bypass, drag-and-drop, cursorjacking, double-clickjacking, and sensitive-action framing.
- ▌ Firmware Acquisition · purpleailabSystematic firmware extraction from IoT and embedded targets — vendor portals, OTA interception, SPI flash dumping with flashrom/CH341A, eMMC chip-off, and UART/JTAG console dumps. Covers the full acquisition chain from zero hardware access to a raw binary ready for static analysis.
- ▌ Gophish Campaign · purpleailabBuild and launch a tracked phishing campaign with the GoPhish REST API — sending profile, groups, email template, landing page, launch, and event polling.
- ▌ Lookalike Domain · purpleailabRegister and provision a lookalike / Punycode phishing domain with DNS and TLS so GoPhish and evilginx2 lures resolve and pass modern mail + browser checks.
- ▌ Reverser Android Malware · purpleailabAndroid APK malware analysis — manifest permission review, smali disassembly, Java decompilation with jadx, dynamic instrumentation with Frida, network traffic interception, native library analysis, and automated scanning with MobSF.
- ▌ Abort Template · purpleailabAbort / crisis plan generator — halt triggers, response actions, AI-aware safety gates (hallucination threshold, destructive-action gate, output validation).
- ▌ Threat Profile · purpleailab bundleThreat actor profiling for adversary emulation — APT group research, sophistication tiers, MITRE ATT&CK mapping, initial access vectors, custom archetypes.
- ▌ Evil Twin Karma · purpleailabEvil-twin rogue AP with KARMA/Mana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK/open networks. Distinct from wpa-enterprise-eap which targets 802.1X.
- ▌ Aatmf T09 Multimodal · purpleailabAATMF T9 — Multimodal & Cross-Channel. Image steganography → text exec, audio prompt injection, video frame inject, document-with-hidden-text.
- ▌ Kimsuky Velvet Chollima · purpleailabAdversary-emulation profile for Kimsuky (G0094 / Velvet Chollima / Emerald Sleet / THALLIUM / Black Banshee / APT43 / TA427), North Korea's RGB 63rd Research Center cyber-espionage actor.
- ▌ Chain Credential Reuse · purpleailabBuild chains where leaked or weak credentials pivot across services to privileged access.
- ▌ Command Injection · purpleailabHunt OS command injection (CWE-78) — user input reaching shell, exec, or system calls. Covers argument-array bypasses, path confusion, and template-string injection in modern frameworks.
- ▌ Ti Ioc Extraction · purpleailabAutomated IOC extraction from threat reports, logs, and unstructured text — parse hashes, IPs, domains, URLs, email addresses, and CVEs. Covers regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation from IOCs, and STIX/TAXII formatting for sharing.
- ▌ Dns Rebinding · purpleailabDNS rebinding attack to bypass browser same-origin policy and reach IMDS/localhost/internal services: TTL=0 rebind mechanics, rbndr.us/singularity tooling, browser DNS cache pinning, chaining into AWS/GCP/Azure IMDS credential pivot. Use when SSRF is blocked but a victim browser can be induced to make requests, or when a localhost service is exposed. Triggers on: 'dns rebinding', 'rebind', 'DNS TTL 0', 'singularity', 'rbndr', 'localhost bypass via browser', 'imds via browser', 'SSRF via DNS'.
- ▌ Open Redirect · purpleailabOpen redirect + tabnabbing — URL filter bypass, OAuth chain extension, phishing infrastructure-free, SSRF chain.
- ▌ Web Discovery · purpleailabWeb app discovery — directory/file fuzzing, vhost discovery, JavaScript endpoint extraction.
- ▌ Reverser Fileless Malware · purpleailabIn-memory and fileless malware detection — AMSI bypass analysis, reflective DLL injection, CLR-hosted payloads, process hollowing, PowerShell cradle chains, WMI/COM persistence, and registry-resident payloads. Covers detection, memory forensics, and payload extraction.
- ▌ Packer Unpacking · purpleailabIdentify and unpack common binary packers — UPX, ASPack, Themida, VMProtect, MPRESS, PECompact, Enigma.
- ▌ Reverser Rootkit Analysis · purpleailabRootkit detection and analysis — UEFI rootkits, kernel-level rootkits, bootkits, DKOM techniques, SSDT/IDT/IRP hooking, hypervisor rootkits, and firmware implant detection using GMER, Volatility, chipsec, and UEFITool.
- ▌ Conops Template · purpleailab bundleConcept of Operations document creation — executive summary, threat actor profiling, attack narrative, kill chain design, communication plan, deconfliction.
- ▌ Chain Ssrf To Rce · purpleailabBuild and validate SSRF pivot chains toward metadata/infra control and final code execution impact.
- ▌ Pattern Exhaustion · purpleailabSystematic pattern exhaustion methodology. Load after finding any confirmed vulnerability to search for all instances of the same root cause pattern across the codebase.
- ▌ Terraform State Leak · purpleailabExploit exposed Terraform state files — secrets, cloud creds, RDS passwords, IAM keys, and infrastructure topology in plain JSON.
- ▌ Signature Replay · purpleailabSignature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.
- ▌ Kali MCP Bridge · purpleailabDeploy and drive Kali Linux tools via MCP-Kali-Server — structured tool-call interface, SSH tunnel setup, prompt-injection hygiene for AI-assisted engagements.
- ▌ Business Logic · purpleailabBusiness logic / authentication bypass / privilege escalation — POST body field tampering (role/is_admin/user_type), 2FA bypass via response manipulation, predictable TOTP seeds, hidden authorization headers, multi-step workflow tampering. For challenges tagged business_logic, privilege_escalation, 2fa_bypass, or auth_bypass that aren't pure IDOR/JWT.
- ▌ Dom Clobbering · purpleailabDOM clobbering — abuse named HTML elements to overwrite JavaScript global variables, bypass CSP, hijack object property lookups.
- ▌ Race Condition · purpleailabRace condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint state-leak races where a session write on one endpoint leaks privilege into another endpoint mid-request.
- ▌ Verb Tampering · purpleailabHTTP verb/method tampering — auth bypass via HEAD/OPTIONS/arbitrary methods, X-HTTP-Method-Override, TRACE/PUT/DELETE exposure, framework routing flaws.
- ▌ Lure Deconfliction · purpleailabMandatory out-of-band handshake with the blue-team contact BEFORE any phishing campaign sends. Skipping this is a critical RoE violation - the engagement has no legal coverage for unannounced phishing of real employees.
- ▌ Mfa Fatigue Social · purpleailabMFA fatigue (push-bombing) combined with help-desk impersonation — overwhelm the target with repeated MFA push notifications and then social-engineer them into approving via a vishing call posing as IT support.