zakirkun
- 224 skills
- 0 followers
- last month last updated
- ▌ OAUTH Misconfiguration · zakirkun bundleDetects common OAuth 2.0 implementation mistakes including missing state parameter, open redirect in redirect_uri, and token exposure.
- ▌ Coupon And Discount Code Abuse · zakirkun bundleDetects discount/coupon code logic without per-user usage limits, allowing unlimited stacking or reuse.
- ▌ SQL Wildcard Grant Privilege · zakirkun bundleDetects SQL GRANT statements with wildcard privileges that over-privilege database users.
- ▌ Command Injection Detection · zakirkun bundleDetects command injection vulnerabilities where user input is passed to OS command execution
- ▌ IOS Jailbreak Detection Bypass Vulnerability · zakirkun bundleDetects weak jailbreak detection implementations that can be easily bypassed.
- ▌ Snmp Weak Community String · zakirkun bundleDetects SNMP configurations using default or weak community strings that allow unauthorized network device management.
- ▌ Missing Gdpr Cookie Consent · zakirkun bundleDetects analytics and tracking scripts loaded without cookie consent mechanisms.
- ▌ HTTP Response Splitting · zakirkun bundleDetects HTTP response splitting via CRLF injection in response headers, enabling cache poisoning and XSS.
- ▌ API Key Without Rotation Or Expiration · zakirkun bundleDetects API key implementations without expiration dates or rotation mechanisms, creating long-lived credentials.
- ▌ Broken Object Level Authorization Bola Idor · zakirkun bundleDetects API endpoints that use user-supplied IDs to access objects without verifying the requesting user owns or has permission to access that object.
- ▌ Azure Misconfiguration · zakirkun bundleDetects common Azure security misconfigurations including public blob storage, overprivileged managed identities, and insecure ARM templates.
- ▌ Cryptographic Key Material Exposure · zakirkun bundleDetects private keys, certificates, and cryptographic key material hardcoded or committed in source code.
- ▌ Ruby Marshal Deserialization · zakirkun bundleDetects Marshal.load() or Marshal.restore() on untrusted data, enabling code execution.
- ▌ Build Artifact Without Integrity Verification · zakirkun bundleDetects CI/CD pipelines that download, use, or publish build artifacts without cryptographic hash verification.
- ▌ Secrets In Dockerfile · zakirkun bundleDetects credentials and secrets hardcoded in Dockerfile ENV instructions or ARG values that end up in image layers.
- ▌ Javascript Prototype Chain Manipulation · zakirkun bundleDetects patterns that allow direct manipulation of the JavaScript prototype chain, enabling prototype pollution and security bypass.
- ▌ Server Side Template Injection Ssti · zakirkun bundleDetects user-controlled input passed directly into template rendering engines, enabling code execution.
- ▌ Insufficient Security Event Logging · zakirkun bundleDetects authentication and authorization events that are not logged, hampering incident detection and forensics.
- ▌ Memory Race Condition · zakirkun bundleDetects concurrent memory access without proper synchronization in C/C++ and Go programs.
- ▌ IOS Insecure Keychain Usage · zakirkun bundleDetects iOS Keychain items stored with insecure accessibility attributes that allow access when device is locked or without user authentication.
- ▌ IOS Realm Database Without Encryption · zakirkun bundleDetects iOS Realm database instances configured without encryption key.
- ▌ Health Medical Data Exposure · zakirkun bundleDetects health and medical information logged, transmitted without encryption, or insufficiently protected, violating HIPAA and similar regulations.
- ▌ Secrets Bundled In Published Packages · zakirkun bundleDetects API keys, private keys, and credentials accidentally included in npm/pip packages via missing .npmignore or .pypiignore.
- ▌ Android Insecure Data Storage · zakirkun bundleDetects sensitive data stored in plaintext in SharedPreferences, SQLite databases, or external storage in Android applications.