SurrealSky

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

SurrealSky/hack_skills

Skill Claude CodeCodex

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

SurrealSky/hack_skills

Skill Claude CodeCodex

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

SurrealSky/hack_skills

Skill Claude CodeCodex

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

SurrealSky/hack_skills

Skill Claude CodeCodex

GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.

SurrealSky/hack_skills

Skill Claude CodeCodex

Access-control bypass for 403 Forbidden responses. Use when a protected path returns 403 but may be reachable via path normalization, HTTP method override, or header-based URL rewriting (X-Original-URL, X-Rewrite-URL, X-Forwarded-).

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.

SurrealSky/hack_skills

Skill Claude CodeCodex

Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

SurrealSky/hack_skills

Skill Claude CodeCodex

CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.

SurrealSky/hack_skills

Skill Claude CodeCodex

CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.

SurrealSky/hack_skills

Skill Claude CodeCodex

IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.

SurrealSky/hack_skills

Skill Claude CodeCodex

OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

SurrealSky/hack_skills

Skill Claude CodeCodex

SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

SurrealSky/hack_skills

Skill Claude CodeCodex

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

SurrealSky/hack_skills

Skill Claude CodeCodex

Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.

SurrealSky/hack_skills

Skill Claude CodeCodex

Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.

SurrealSky/hack_skills

Skill Claude CodeCodex

Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

SurrealSky/hack_skills

Skill Claude CodeCodex

CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.

SurrealSky/hack_skills

Skill Claude CodeCodex

CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT). Use when exports, imports, or user fields feed spreadsheets or reporting tools.

SurrealSky/hack_skills

Skill Claude CodeCodex

Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.

SurrealSky/hack_skills

Skill Claude CodeCodex

Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.