securityfortech/hacking-skills
Skill Claude CodeCodex
Exploit path traversal and local/remote file inclusion (LFI/RFI) via URL parameters, cookies, and hidden fields using ../ sequences, URL encoding (%2e%2e%2f), double encoding (%252e%252e%255c), Unicode bypasses (..%c0%af), and Windows UNC paths. PHP include/require with $GET/$POST/$COOKIE pattern. Target /etc/passwd…
securityfortech/hacking-skills
Skill Claude CodeCodex
Clickjacking overlays a target page in a transparent or hidden iframe, tricking victims into clicking UI elements they cannot see. Detect by attempting to load the target in an iframe and checking for X-Frame-Options (DENY/SAMEORIGIN) or Content-Security-Policy: frame-ancestors headers. Frame-busting JavaScript can be…
securityfortech/hacking-skills
Skill Claude CodeCodex
CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the Origin header in Access-Control-Allow-Origin or set it to with Access-Control-Allow-Credentials: true. Detect via Origin: https://attacker.com reflection in Access-Control-Allow-Origin response…
securityfortech/hacking-skills
Skill Claude CodeCodex
Use when hunting Client-Side Path Traversal (CSPT) vulnerabilities where attacker- controlled input is unsafely concatenated into the path component of a JavaScript fetch() or XHR request. Trigger on: "CSPT", "client-side path traversal", "fetch path traversal", "XHR path injection", "fetch concatenation", "../ in…
securityfortech/hacking-skills
Skill Claude CodeCodex
Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting forged requests to a target application by exploiting browser automatic cookie attachment. Detect via missing or predictable CSRF tokens in state-changing requests (POST/PUT/DELETE), absent SameSite cookie attributes, and JSON endpoints…
securityfortech/hacking-skills
Skill Claude CodeCodex
DOM-based XSS occurs when JavaScript reads attacker-controlled sources (location.hash, document.referrer, window.name, location.search) and passes them to dangerous sinks (document.write, innerHTML, eval, location.href, setTimeout, jQuery.html()) without sanitization. Unlike reflected/stored XSS, payloads never reach…
securityfortech/hacking-skills
Skill Claude CodeCodex
Applications that accept a URL or path from user input and redirect to it without validating the destination allow attackers to craft links that appear to originate from a trusted domain but send victims to attacker-controlled pages. Commonly used for phishing, OAuth token theft, and as a stepping stone to reflected…
securityfortech/hacking-skills
Skill Claude CodeCodex
OS command injection occurs when user input is passed unsanitized to a system shell via dangerous APIs: Java Runtime.exec(), Python os.system/subprocess, PHP system/shellexec/exec/procopen, C system/exec. Detect via pipe |, semicolon ;, &&, ||, backtick, $() operators, and time-delay payloads (sleep 5). Tools: Commix…
securityfortech/hacking-skills
Skill Claude CodeCodex
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting Content-Length and Transfer-Encoding: chunked headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking…
securityfortech/hacking-skills
Skill Claude CodeCodex
SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL…
securityfortech/hacking-skills
Skill Claude CodeCodex
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via file:// scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators…
securityfortech/hacking-skills
Skill Claude CodeCodex
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions {{77}} returning 49, or ${77}, . Leads to full RCE via template sandbox escape…
securityfortech/hacking-skills
Skill Claude CodeCodex
Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting alert(1) , event handlers like onfocus, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE)…
securityfortech/hacking-skills
Skill Claude CodeCodex
Stored XSS (persistent XSS) occurs when attacker-supplied input is saved server-side and later rendered unencoded to other users. Common injection points include profile fields, comments, forum posts, file upload filenames, and application logs. Detect via PHP $GET/$POST/$REQUEST/$FILES, ASP Request.Form, JSP…
securityfortech/hacking-skills
Skill Claude CodeCodex
XML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (file:///etc/passwd), SSRF via http:// entities, and DoS via Billion Laughs. Vulnerable Java APIs include DocumentBuilder, SAXParser, dom4j, TransformerFactory, SAXReader…
securityfortech/hacking-skills
Skill Claude CodeCodex
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via…
securityfortech/hacking-skills
Skill Claude CodeCodex
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema"…
securityfortech/hacking-skills
Skill Claude CodeCodex
File upload endpoints that validate file type only by extension or Content-Type header allow attackers to upload executable files, XSS payloads, XXE-triggering documents, or path-traversal archives. Depending on where files are stored and served, impact ranges from stored XSS to full remote code execution.
securityfortech/hacking-skills
Skill Claude CodeCodex
Identify web server type/version, framework, and application entry points via banner grabbing, HTTP header analysis (Server, X-Powered-By, X-Generator), cookie names (CAKEPHP, laravelsession, wp-settings), HTML meta generators, robots.txt, source map files (.map), JS hardcoded secrets, and Google dorking (site:…
securityfortech/hacking-skills
Skill Claude CodeCodex
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent Host- and Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session…
securityfortech/hacking-skills
Skill Claude CodeCodex
Detect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze…