galact-byte

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding authentication and authorization bypasses in authorized tests. Authentication checks who you are; authorization checks what that account is allowed to do.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding web cache poisoning and cache deception in authorized tests. It examines cases where a CDN or reverse proxy stores a response using an incomplete or different cache key.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding command injection, where user input is treated as part of an operating-system command or an external program's arguments. It covers web applications, APIs, and continuous-integration systems in authorized tests.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding cross-site request forgery, or CSRF, where another site causes a user’s browser to send an unwanted state-changing request. It also tests ways common CSRF protections might be bypassed in authorized tests.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding insecure deserialization, where user-controlled data is rebuilt into an application object. It covers formats and mechanisms used by PHP, Ruby, Python, Java, and .NET applications in authorized tests.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing skill for checking whether Node.js's built-in permission controls can be bypassed. It covers the current permission model and older policy files.

galact-byte/galact-Skills

Skill Claude CodeCodex

A guide for finding open redirects during authorised penetration tests. An open redirect is a website feature that sends a user to an attacker-chosen outside URL, often through parameters such as next, redirect, or returnUrl.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding path traversal, where crafted file names or paths escape an intended directory. It also covers unsafe archive extraction, symbolic links, and archive entries that overwrite files in authorized tests.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for finding JavaScript prototype pollution in authorised tests of Node.js servers, REST APIs, and web pages. Prototype pollution happens when user input adds unwanted properties to shared JavaScript objects.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing guide for HTTP request smuggling, an attack caused by proxy and server disagreeing about where an HTTP request ends.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing skill for finding SQL injection and NoSQL injection in web applications and APIs during authorized penetration tests. SQL injection tricks a database query through user input; NoSQL injection targets databases such as MongoDB.

galact-byte/galact-Skills

Skill Claude CodeCodex

A workflow for authorized security testing of SSRF, a vulnerability where a server is tricked into sending requests to locations chosen by a user.

galact-byte/galact-Skills

Skill Claude CodeCodex

An authorised security-testing workflow for finding cross-site scripting, or XSS, in web pages and APIs. XSS occurs when attacker-controlled input is run or displayed as unsafe browser code.

galact-byte/galact-Skills

Skill Claude CodeCodex

Uma ferramenta para encontrar falhas de injeção de entidades externas em XML (XXE), durante testes de invasão autorizados. XML é um formato de texto usado por APIs, documentos e arquivos como SVG, DOCX e XLSX.

galact-byte/galact-Skills

Skill Claude CodeCodex

A security-testing triage guide for identifying a target’s attack surface—the features and components that could be exposed to attack—and choosing suitable tests.