akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Extract sensitive training data and internal capabilities from AI models through repeated programmatic querying. Use this skill when testing LLMs and ML models for data privacy leaks, intellectual property exposure, or unintended memorization. Covers membership inference, prompt extraction, training data…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Execute advanced LLM Jailbreaking techniques using roleplay, nested environments (virtual machines), and complex personas to completely bypass safety constraints and ethical alignments embedded in AI models.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit vulnerabilities in Applications integrating Large Language Models (LLMs). Prompt Injection involves crafting inputs that override the original system instructions provided by the developer, allowing an attacker to exfiltrate data, bypass restrictions, or manipulate the AI's output logic.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit vulnerabilities in the AI Supply Chain by injecting malicious models, datasets, or dependencies. Use this skill to simulate advanced persistent threats (APTs) compromising Hugging Face repositories, manipulating pre-trained weights (Model Poisoning), and exploiting insecure deserialization during…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Writes professional bug bounty reports for HackerOne, Bugcrowd, and Intigriti with CVSS 4.0 scoring, business impact, working exploits, and remediation. Runs 5-check Pre-Report Verification first: hallucination detection, AI writing patterns, PoC reproducibility, duplicate detection, and impact plausibility. Use when…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Systematically discover hidden Application Programming Interfaces (APIs), uncover undocumented endpoints (Shadow APIs), and fuzz parameters. Use this skill as the pivotal first step in API Bug Hunting, transforming a basic frontend application into a vast mapped attack surface.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., isadmin, verified) to illegally modify restricted properties.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit Broken Object Level Authorization (BOLA), historically known as Insecure Direct Object Reference (IDOR), in API architectures. Extremely common and critical flaw where an API fails to validate whether the currently authenticated user actually owns or retains permissions over the specifically…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Exploit GraphQL API architectural features to execute highly efficient brute-force, Credential Stuffing, and Denial of Service (DoS) attacks. Utilize Query Batching and Alias injection to bypass rate limits by packing thousands of requests into a single HTTP POST request.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit GraphQL API vulnerabilities by leveraging Introspection queries to dump the entire database schema, performing query batching to bypass rate limits (brute forcing), and extracting deeply nested unauthorized data via graph relationship abuse.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Exploit implementations of JSON Web Tokens (JWT) through algorithmic confusion (e.g., RS256 to HS256), "none" algorithm attacks, and signature stripping. Use this skill to forge administration tokens and achieve unauthenticated Account Takeover (ATO) on REST APIs and modern web applications.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit logical flaws in OAuth 2.0 and OpenID Connect workflows. Use this skill when testing "Sign in with Google/Facebook/Apple" features, focusing on Authorization Code interception, Implicit flow token leakage, standard CSRF bypassing via missing state parameters, and redirect logic flaws.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Exploit exposed GraphQL introspection endpoints to map the entire API schema. This skill details how to extract available queries, mutations, types, and fields, which significantly aids in identifying hidden endpoints, Broken Object Level Authorization (BOLA/IDOR), and mass assignment vulnerabilities.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit Algorithm Confusion vulnerabilities in JSON Web Tokens (JWT). This skill details how to bypass signature verification by changing the signing algorithm from asymmetric (RS256) to symmetric (HS256) and using the public key as the symmetric secret.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Exploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the alg header set to none, allowing attackers to forge tokens without a valid signature.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Exploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging…
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques.
akashrpatil/awesome-offensive-security-skills
Skill Claude CodeCodex
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques.