wufufu770
- 232 skills
- 0 followers
- 5 hours ago last updated
- ▌ Info Leak 2 · wufufu770Detect sensitive information leakage in web applications and APIs - exposed API keys, tokens, PII in HTML/JS, debug pages, source maps, .git directories, .env files, backup files, internal IPs, stack traces, and version strings. Use during reconnaissance to identify sensitive data exposed to attackers.
- ▌ Hunt Rce 2 · wufufu770Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.
- ▌ Hunt Xss 2 · wufufu770Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflect
- ▌ Hunt Xxe 2 · wufufu770Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML As
- ▌
- ▌ Hunt Cors 2 · wufufu770"Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs,
- ▌ Hunt Csrf 2 · wufufu770Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAut
- ▌ Hunt Idor 2 · wufufu770Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
- ▌ Hunt Sqli 2 · wufufu770Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $
- ▌ Hunt Ssrf 2 · wufufu770Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exc
- ▌ Hunt Ssti 2 · wufufu770"Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thym
- ▌ Component Nday 2 · wufufu770组件 N-day 主线流水线：指纹识别 → CVE 匹配 → PoC 复现 → 影响面论证 → 通用型报告。 触发词：组件漏洞、N-day、指纹识别、CVE匹配、CNVD通用型。目标已识别出组件指纹或需要产出通用型报告时必走此链。
- ▌
- ▌
- ▌ Info Leak 3 · wufufu770信息泄露猎捕：.git/.env/备份文件、source map 还原源码、JS 内硬编码密钥、调试端点、堆栈泄露。 触发词：信息泄露、敏感信息、源码泄露、配置泄露、API密钥。侦察阶段必做，全流程持续检查。
- ▌
- ▌ Src Session Start 2 · wufufu770挖掘会话启动器：确认卡 → 会话目录骨架 → 按模式挂载技能集 → 路由报告模板。 触发词：开始挖、启动挖掘、开工、开始测试。用户下达"开始挖 XX"类指令时必先走本 skill，其余 skill 一律由本链路挂载。
- ▌ Second Opinion 2 · wufufu770Get a second independent perspective on a finding or attack approach before committing. Review the evidence chain (request/response, payload, success criteria), assess whether the conclusion holds under alternative interpretations, and suggest additional verification steps. Use when an unusual finding seems too good to be true, or when a complex attack chain needs sanity-checking before exploitation.
- ▌ Hunt Host Header 2 · wufufu770"Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Bu
- ▌ Hunt Cache Poison 2 · wufufu770Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization W
- ▌
- ▌ API Authentication 2 · wufufu770API 认证弱点测试：JWT 缺陷（none/弱密钥/混淆）、token 泄露、接口鉴权缺失与 BOLA。触发词：API认证、JWT、token、BOLA、接口未授权。
- ▌ Cve Poc Generator 2 · wufufu770Generate or adapt Proof-of-Concept (PoC) exploits for known CVEs from public sources. Search ExploitDB, GitHub advisories, Metasploit modules, and Nuclei templates; adapt payloads to the target's specific component version; ensure PoC is reproducible and safe (read-only where possible). Use after fingerprinting identifies a known vulnerable version.
- ▌ Prototype Pollution 2 · wufufu770JS 原型污染：客户端/服务端入口点识别、gadget 分析、向 XSS/RCE 的利用升华。触发词：原型污染、prototype pollution、__proto__。
- ▌ Src Session Start 3 · wufufu770挖掘会话启动器：确认卡 → 会话目录骨架 → 按模式挂载技能集 → 路由报告模板。 触发词：开始挖、启动挖掘、开工、开始测试。用户下达"开始挖 XX"类指令时必先走本 skill，其余 skill 一律由本链路挂载。
- ▌ Fs Spec Game · wufufu770全栈·游戏方向实现规格生成器。2D 像素/手绘、3D 动作/开放世界、Web 游戏(Three.js)、引擎插件、着色器、物理模拟、VR/AR、游戏音频。用户提"游戏/WebGL 交互/玩法原型"的规范时使用。属 it-project-spec-generator 体系。
- ▌ Sec Spec Grc · wufufu770网络安全·治理合规与密码学方向规格生成器。等保 2.0、ISO 27001、GDPR/个保法隐私合规、风险登记册、安全度量指标、应用密码学参数(算法选择/密钥轮换)、密钥管理体系。触发词：等保测评/合规差距分析/隐私合规/加密方案选型/密钥管理制度。属 it-project-spec-generator 体系。
- ▌ Fs Spec Devops · wufufu770全栈·DevOps 与基础设施方向实现规格生成器。CI/CD 流水线、IaC(Terraform/Pulumi)、容器与 K8s/Helm、可观测性(指标/日志/追踪/告警)、服务网格、云平台成本与配额、边缘 CDN。用户提"部署方案/流水线/K8s 编排/监控告警"的规范时使用。属 it-project-spec-generator 体系。
- ▌ Fs Spec Mobile · wufufu770全栈·移动方向实现规格生成器。iOS 原生(SwiftUI/UIKit)、Android 原生(Compose)、React Native、Flutter、移动 CI(Fastlane) 与移动测试(Appium)。用户提"App/移动端/跨端小程序"的规范时使用。属 it-project-spec-generator 体系。
- ▌ Sec Spec Cloud · wufufu770网络安全·云与基础设施安全方向规格生成器。IAM 最小权限、云账号基线(CIS Benchmark)、容器与 K8s 安全(策略/RBAC/网络策略/镜像)、密钥管理(Vault/KMS)、CSPM 配置审计、零信任网络分段。触发词：云安全加固/K8s 安全/IAM 设计/镜像安全/零信任方案。属 it-project-spec-generator 体系。
- ▌ Fs Spec Backend · wufufu770全栈·后端方向实现规格生成器。REST/GraphQL/gRPC API、微服务、消息队列(Kafka/RabbitMQ)、任务调度、认证授权(OAuth/OIDC/JWT)、API 网关、文件存储、支付、邮件。用户提"接口设计、服务端、微服务、后端规范"时使用。属 it-project-spec-generator 体系。
- ▌ Fs Spec Data AI · wufufu770全栈·数据与 AI 方向实现规格生成器。数据管道(Airflow/dbt)、流处理(Flink/Spark)、SQL 分析、特征存储、数据湖、ML 训练与服务化、LLM 应用、RAG、数据可视化。用户提"数据平台/ETL/大模型应用/RAG/推荐系统"的规范时使用。属 it-project-spec-generator 体系。
- ▌ Sec Spec Appsec · wufufu770网络安全·应用安全(SDL)方向规格生成器。安全开发生命周期、威胁建模(STRIDE)、代码审计方案、SAST/DAST/SCA 工具矩阵与门禁、密钥扫描、SBOM 与供应链安全、安全编码规范。触发词：SDL 流程/代码审计计划/威胁建模/供应链安全/安全门禁。属 it-project-spec-generator 体系。
- ▌ Fs Spec Frontend · wufufu770全栈·前端方向实现规格生成器。Web 界面类交付物：响应式官网、SPA、SSR/SSG、组件库与设计系统、微前端、PWA、浏览器扩展、CSS 与动画、跨端 H5。用户提"页面/组件库/仪表板/官网/可视化大屏"的规范与实现细节时使用。属 it-project-spec-generator 体系。
- ▌ Sec Spec Redteam · wufufu770网络安全·红队评估方向规格生成器。内网渗透、域环境(AD)攻防、红队评估方案与 ROE 交战规则、C2 基础设施规划、ATT&CK 对抗映射、攻击时间线报告。触发词：红队方案/内网渗透计划/AD 攻防演练/ROE 文档。仅限书面授权的演练用途，规格强制含 ROE 章节。
- ▌ Sec Spec Detection · wufufu770网络安全·蓝队检测与响应方向规格生成器。检测工程(Sigma/YARA/Suricata 规则)、SIEM 接入与字段规范化、威胁狩猎、应急响应预案(PICERL)、数字取证(DFIR)流程。触发词：检测规则/告警策略/SIEM 方案/应急响应预案/取证流程。属 it-project-spec-generator 体系。
- ▌ Fs Spec Desktop CLI · wufufu770全栈·桌面与 CLI 方向实现规格生成器。Electron、Tauri、WPF/WinUI、Qt、macOS 原生、Linux GTK、终端 TUI(Textual/Bubble Tea)、命令行工具。用户提"桌面应用/命令行工具/终端程序"的规范时使用。属 it-project-spec-generator 体系。
- ▌ Sec Spec Web Pentest · wufufu770网络安全·Web 渗透方向规格生成器。Web/API/小程序渗透测试方案、漏洞挖掘计划、SRC/EduSRC 提交报告、CNVD/CNNVD 通用漏洞报告、众测交付物。触发词：渗透测试方案/漏洞挖掘计划/SRC 报告/CNVD 提交/挖洞计划。仅限授权测试用途，规格强制含授权范围章节。
- ▌ It Project Spec Generator · wufufu770IT 项目实现规格生成总纲与路由器。把一句想法变成可开工、可验收的工程规格；自动路由到 13 个领域子 skill（全栈 7 + 安全 6）。触发词：生成提示词/写实现规范/详细实现规格/项目规格/设计一个系统/做个项目的规格。混合领域或跨领域需求由本 skill 直接处理。
- ▌ Tri Ring · wufufu770 bundle三环并行渗透编排：广度发现环(N实例并行) + 深度攻击环(信号驱动三层递进) + 创造探索环(反思唤醒) + 仲裁层(质量门控)，靠共享图状态层协同；含防卡死、检查点恢复、经验沉淀。 触发词：三环、并行挖掘、tri-ring、大规模测试。目标模块多、需要跨端点组合攻击链时使用本架构， 替代单线程逐个挖的旧模式。
- ▌ Kev · wufufu770CISA KEV 已知被利用漏洞目录比对：组件 CVE 是否在 KEV 清单、优先级判定。触发词：KEV、已利用漏洞、在野利用。component-nday 匹配出 CVE 后必查。
- ▌ Fp Check · wufufu770误报交叉验证门禁：用第二工具独立复现候选发现（如 Burp 报了 SQLi 则用 sqlmap/curl 复测），双确认才可写报告。触发词：误报、验证、复测、交叉确认。任何发现写入报告前强制执行。
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Hunt Sqli · wufufu770SQL 注入挖掘：布尔/时间盲注、报错、堆叠查询、NoSQL 注入，含 OOB 外带确认门禁。触发词：注入、SQLi、盲注、数据库报错。目标存在 DB 交互参数时使用。
- ▌
- ▌ Hunt Ssti · wufufu770SSTI 模板注入挖掘：引擎指纹判别（Jinja2/Twig/Freemarker）、payload 阶梯升级与沙箱边界。触发词：SSTI、模板注入、模板渲染异常。
- ▌ Info Leak · wufufu770信息泄露猎捕：.git/.env/备份文件、source map 还原源码、JS 内硬编码密钥、调试端点、堆栈泄露。 触发词：信息泄露、敏感信息、源码泄露、配置泄露、API密钥。侦察阶段必做，全流程持续检查。
- ▌ Waf Bypass · wufufu770WAF 绕过方法论：指纹识别、编码混淆、语法等价替换、分块传输与竞态技巧。触发词：WAF、绕过、拦截、安全狗/宝塔。被 WAF 拦截时加载本 skill。
- ▌ Gh CLI · wufufu770Enforces authenticated gh CLI workflows over unauthenticated curl/WebFetch patterns. Use when working with GitHub URLs, API access, pull req…
- ▌ Second Opinion · wufufu770独立复核：对复杂或反直觉发现穷举替代解释、置信度评分(1-10)、给出补充验证步骤。触发词：第二意见、复核、太好了不像真的。fp-check 通过后对高影响发现使用。
- ▌
- ▌
- ▌
- ▌ Src Info Leak · wufufu770Dedicated information leakage hunting skill - identify exposed secrets, debug endpoints, and sensitive data in web applications. Different from generic info-leak: focuses on patterns and places where bounty targets commonly leak (login pages, source code, admin panels). Includes manual review techniques beyond automated scanners.
- ▌ Hunt Ato · wufufu770"Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hu
- ▌ Hunt Lfi · wufufu770"Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no up
- ▌
- ▌ Component Nday · wufufu770Fingerprint web application components and match against known N-day vulnerabilities (CVEs, public PoCs). Use exposed version strings, header fingerprints, and behavioral patterns to identify the exact component and version, then query CVE databases (NVD, KEV, ExploitDB) for known exploits. Core workflow for SRC/CNVD generic-type report generation.
- ▌ Hunt Cicd · wufufu770"Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/
- ▌ Hunt Grpc · wufufu770"Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grp
- ▌ Hunt Misc · wufufu770Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
- ▌ Hunt Saml · wufufu770"Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, commen
- ▌ Nmap Advanced · wufufu770Nmap 高级扫描：服务与版本识别、NSE 脚本选型、速率控制与非干扰扫描策略。触发词：nmap、端口扫描、服务识别。注意速率红线，禁止全端口高并发打公网。
- ▌ C Review · wufufu770Perform c review assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌
- ▌ Src API Testing · wufufu770 bundlePerform src api testing assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Src Auth Bypass · wufufu770 bundlePerform src auth bypass assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Git Cleanup · wufufu770Perform git cleanup assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Hunt OAUTH · wufufu770Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
- ▌ Hunt LLM AI · wufufu770attacker-controlled listener — proves the agent reached out and what it carried
- ▌
- ▌
- ▌ Security Headers · wufufu770安全响应头审计：CSP/HSTS/XFO/Referrer-Policy 缺陷评估与修复基线建议。触发词：安全头、CSP、响应头、headers。低危快速项，适合凑覆盖面。
- ▌
- ▌ Src Session Start · wufufu770Perform src session start assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Github Triage · wufufu770Triage GitHub repository issues and PRs - merge ready automated PRs, close resolved resolved, issues, cross-link with fix PRs, and assign local-only priority estimates.
- ▌ Cve Poc Generator · wufufu770CVE PoC 生成与验证：从公开情报构建最小可复现验证器，输出标准化 PoC 文件。触发词：PoC、EXP编写、漏洞复现脚本。无现成 PoC 的 N-day 由本 skill 补位。
- ▌ API Authentication · wufufu770API 认证弱点测试：JWT 缺陷（none/弱密钥/混淆）、token 泄露、接口鉴权缺失与 BOLA。触发词：API认证、JWT、token、BOLA、接口未授权。
- ▌ JS Reverse · wufufu770JS 逆向与接口发现：运行时抓 XHR/fetch 定位真实数据接口、全量 JS 提取未触发 path、 XHR 断点回溯签名生成函数、借页面自身 JS 现场签名、webpack chunk 挖隐藏路由、 响应 ID 字段喂给后续越权测试。触发词：JS 逆向、签名还原、加密参数、隐藏接口。 侦察与攻击衔接阶段使用：当目标接口带签名/加密参数、或常规爬取拿不到真实 API 清单时必做。
- ▌ Rust Review · wufufu770Perform rust review assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Src Component Nday · wufufu770Workflow for component N-day vulnerability hunting — fingerprint, CVE match, PoC development, impact argumentation, report generation. The complete pipeline for SRC/CNVD generic-type reports. Bridges recon (fingerprint) through validation (fp-check) to reporting.
- ▌ Patt Fetcher · wufufu770Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment
- ▌ Hunt Dispatch · wufufu770Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Us
- ▌ Prototype Pollution · wufufu770JS 原型污染：客户端/服务端入口点识别、gadget 分析、向 XSS/RCE 的利用升华。触发词：原型污染、prototype pollution、__proto__。
- ▌ Hunt RAG Vector · wufufu770Perform hunt rag vector assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the ta
- ▌ Cloud Iam Deep · wufufu770Perform cloud iam deep assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the tar
- ▌
- ▌ Security Arsenal · wufufu770Perform security arsenal assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Hunt Brute Force · wufufu770"Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-Fo
- ▌ Hunt Sharepoint · wufufu770Perform hunt sharepoint assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ External Recon Osint · wufufu770外部侦察总纲：WHOIS/IP 归属、邮箱人员情报、Google dork、公开泄露面排查。触发词：侦察、OSINT、dork、信息收集。
- ▌ Offensive Osint · wufufu770 bundlePerform offensive osint assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.
- ▌ Static Analysis · wufufu770"Reuse this database" - label: "<db_path_2> (language: cpp, created: 2026-02-23)" description: "Reuse this database" - label: "Build a new database" description: "Create a fresh database in a new output directory" ``` After selection: - **If user picks an existing database:** Set `$OUTPUT_DIR` to its parent directory (or the directory containing it), set `$DB_NAME` to the selected path, then proceed to extensions → analysis. - **If user picks "Build new":** Resolve a new `$OUTPUT_DIR`, execute b
- ▌ M365 Entra Attack · wufufu770Perform m365 entra attack assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the
- ▌ Firebase Apk Scanner · wufufu770Perform firebase apk scanner assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.