Skill Claude CodeCodex needs its repo
Use when hunting Client-Side Path Traversal (CSPT) vulnerabilities where attacker- controlled input is unsafely concatenated into the path component of a JavaScript fetch() or XHR request. Trigger on: "CSPT", "client-side path traversal", "fetch path traversal", "XHR path injection", "fetch concatenation", "../ in…
Skill Claude CodeCodex
Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting forged requests to a target application by exploiting browser automatic cookie attachment. Detect via missing or predictable CSRF tokens in state-changing requests (POST/PUT/DELETE), absent SameSite cookie attributes, and JSON endpoints…
Skill Claude CodeCodex
DOM-based XSS occurs when JavaScript reads attacker-controlled sources (location.hash, document.referrer, window.name, location.search) and passes them to dangerous sinks (document.write, innerHTML, eval, location.href, setTimeout, jQuery.html()) without sanitization. Unlike reflected/stored XSS, payloads never reach…
Skill Claude CodeCodex
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting Content-Length and Transfer-Encoding: chunked headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking…
Skill Claude CodeCodex
Applications that accept a URL or path from user input and redirect to it without validating the destination allow attackers to craft links that appear to originate from a trusted domain but send victims to attacker-controlled pages. Commonly used for phishing, OAuth token theft, and as a stepping stone to reflected…
Skill Claude CodeCodex
SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL…
Skill Claude CodeCodex
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via file:// scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators…
Skill Claude CodeCodex
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions {{77}} returning 49, or ${77}, . Leads to full RCE via template sandbox escape…
Skill Claude CodeCodex
Reflected XSS occurs when user-supplied input is echoed in an HTTP response without sanitization, allowing script execution in the victim's browser. Detect via injecting alert(1) , event handlers like onfocus, HTML entity bypass, and encoding variants. Tools: Burp Suite, OWASP ZAP, PHP Charset Encoder (PCE)…
Skill Claude CodeCodex
Stored XSS (persistent XSS) occurs when attacker-supplied input is saved server-side and later rendered unencoded to other users. Common injection points include profile fields, comments, forum posts, file upload filenames, and application logs. Detect via PHP $GET/$POST/$REQUEST/$FILES, ASP Request.Form, JSP…
Skill Claude CodeCodex
XML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (file:///etc/passwd), SSRF via http:// entities, and DoS via Billion Laughs. Vulnerable Java APIs include DocumentBuilder, SAXParser, dom4j, TransformerFactory, SAXReader…
Skill Claude CodeCodex
Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and credential transport over HTTP. Detectable…
Skill Claude CodeCodex
Test horizontal and vertical authorization bypass via session ID swapping between accounts, IDOR through parameter manipulation (invoice=, user=, menuitem=, EventID=), and special header injection (X-Original-URL, X-Rewrite-URL, X-Forwarded-For, X-Remote-IP, X-Client-IP with 127.0.0.1/localhost/RFC1918 values). Tools…
Skill Claude CodeCodex
Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal…
Skill Claude CodeCodex
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via…
Skill Claude CodeCodex
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent Host- and Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session…
Skill Claude CodeCodex
Identify and exploit default or weak credentials on web application login forms, admin panels, CMS backends (WordPress wp-admin, Joomla, Drupal), and embedded device management interfaces. Signals include framework fingerprinting (WhatWeb, Wappalyzer, Nikto), exposed admin paths from robots.txt/dirbusting, and weak…
Skill Claude CodeCodex
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema"…
Skill Claude CodeCodex needs its repo
JWTs that accept alg: none, trust the algorithm declared in the token header, or use guessable HMAC secrets allow attackers to forge arbitrary tokens — including admin-level claims — without knowing any signing key. Algorithm confusion attacks exploit servers that accept both RS256 (asymmetric) and HS256 (symmetric)…
Skill Claude CodeCodex
Frameworks that automatically bind request body parameters to model attributes (Rails, Laravel, Django, Mongoose, Sequelize) allow attackers to set fields that were never meant to be user-modifiable. A profile update endpoint intended to accept {name, email} will also accept {role: "admin", plan: "enterprise"…
Skill Claude CodeCodex
Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker…
Skill Claude CodeCodex
Detect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze…
Skill Claude CodeCodex
Detects authentication and biometric bypass vulnerabilities in mobile apps (Android/iOS). Trigger on: BiometricPrompt, LocalAuthentication, LAContext, evaluatePolicy, CryptoObject, Android Keystore, Secure Enclave, kSecAccessControlBiometryCurrentSet, userAuthenticationValidityDurationSeconds, confirmCredentials…
Skill Claude CodeCodex
Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: