vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Mutual TLS (mTLS) security testing skill. Covers certificate validation bypass, client certificate spoofing, mTLS downgrade attacks, and certificate pinning bypass. Use when testing mTLS implementations.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows…
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
API rate limiting and resource exhaustion testing skill. Covers rate limit bypass, resource exhaustion, pagination abuse, batch endpoint abuse, and denial-of-service via API resource consumption. Use when testing API rate limiting and resource controls.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
API cost/resource exhaustion: pagination abuse, expensive endpoint DoS, async job flooding, nested object expansion, and size limit bypass. Use when testing API resource limits.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Distributed API race conditions: HTTP/2 single-packet attack, cross-endpoint TOCTOU, parallel write contention, rate-limit race bypass, and multi-step workflow races across microservices.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
API supply chain security testing skill. Covers dependency confusion, package hijacking, CI/CD pipeline attacks, third-party API trust, and upstream dependency vulnerability assessment. Use when evaluating API supply chain security.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
API versioning abuse: outdated version endpoint discovery, version diff analysis for weaker security controls, deprecated endpoint access, and authorization bypass via older API versions.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Stateful API fuzzing: sequence-dependent endpoint testing, multi-step workflow fuzzing, state machine violation, and resource lifecycle manipulation. Use when testing complex API workflows.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing…
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
OAuth 2.0 attack checklist: authorization code interception, redirecturi bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
GraphQL security testing checklist: introspection abuse, batching attacks, query depth/complexity DoS, field suggestion enumeration, IDOR via GraphQL, injection through arguments, authorization bypass. Use when assessing GraphQL endpoints in web app tests or bug bounty.