Skill Claude CodeCodex
A complete playbook for penetration testing Google Cloud Platform (GCP), Google's cloud-computing service. It covers cloud services such as storage buckets, virtual machines, serverless functions, and Kubernetes Engine.
Skill Claude CodeCodex
A playbook for moving from Google Cloud Platform (GCP) into Google Workspace, the suite containing services such as Gmail, Drive, Calendar, and administration tools.
Skill Claude CodeCodex
A playbook for penetration testing Huawei Cloud, including its identity, virtual-machine, storage, database, container, function, and logging services.
Skill Claude CodeCodex
A playbook for attacking Kubernetes, a system that manages groups of containers across machines. It focuses on escaping containers and taking control of cluster components or nodes.
Skill Claude CodeCodex
A playbook for testing IngressNightmare, a Kubernetes Ingress-NGINX admission-controller vulnerability that can allow unauthorised remote code execution under specific conditions.
Skill Claude CodeCodex
A guide to assessing Istio security controls in Kubernetes. Istio is a service mesh that manages traffic between services, while Envoy is the proxy often placed beside each application container.
Skill Claude CodeCodex
A guide to discovering services and networks from inside a Kubernetes cluster after access to a container has been obtained. It includes Kubernetes-aware and DNS-based discovery methods.
Skill Claude CodeCodex
A guide to assessing sidecar containers in Kubernetes. A sidecar is an additional container in the same Pod, often used to proxy network traffic for the main application.
Skill Claude CodeCodex
A guide to assessing shared storage mounted inside Kubernetes containers, such as NFS, EFS, persistent volumes, ConfigMaps, and Secrets.
Skill Claude CodeCodex
A guide to assessing Kubernetes admission webhooks and policy engines. These components inspect or modify requests before Kubernetes accepts them; examples include Kyverno, OPA Gatekeeper, and custom webhooks.
Skill Claude CodeCodex
A guide to assessing misconfigured cloud object-storage buckets, including AWS S3, Alibaba OSS, Tencent COS, and Huawei OBS. These services store files and other objects in remotely accessible buckets.
Skill Claude CodeCodex
A guide to security testing for serverless functions, which are cloud-hosted programs that run in response to events without a continuously running server. It covers services such as AWS Lambda, Tencent Cloud SCF, Alibaba Cloud FC, and Azure Functions.
Skill Claude CodeCodex
A guide to penetration testing Tencent Cloud environments. Tencent Cloud provides services such as object storage, virtual machines, databases, containers, serverless functions, load balancers, logs, and key management.
Skill Claude CodeCodex
A structured method for auditing Java source code for security problems. It follows the path from routes and permissions through data flows, vulnerability checks, and possible exploit chains, requiring evidence for each finding.
Skill Claude CodeCodex
A guide to auditing authentication and security settings in Java source code. It covers access controls, tokens, encryption, information exposure, and business-process flaws.
Skill Claude CodeCodex
A method for joining separate Java security findings into one possible attack path. It also assesses whether known CVEs in Maven or Gradle dependencies are actually reachable and exploitable in the project.
Skill Claude CodeCodex
A Java source-code security audit for finding unsafe file operations.
Skill Claude CodeCodex
A Java source-code audit for security problems in common frameworks and libraries.
Skill Claude CodeCodex
A Java source-code audit for security problems in browser-facing output, requests, redirects, headers, cookies, and sessions. It covers XSS, CSRF, open redirects, CRLF injection, and session-management flaws.
Skill Claude CodeCodex
A Java source-code audit for injection flaws, where untrusted input is interpreted as a database query, command, network request, directory query, expression, or document query. It covers SQL, command, SSRF, LDAP, SpEL or OGNL, and NoSQL injection.
Skill Claude CodeCodex
A Java source-code security audit for risks in serialization, XML parsing, and template engines. It checks native deserialization, XXE (when unsafe XML processing reads external entities), and template injection that can lead to code execution.
Skill Claude CodeCodex
A structured method for auditing PHP source code for security vulnerabilities. It moves through route mapping, permission modeling, data-flow tracing, category-specific checks, and attack-chain analysis.
Skill Claude CodeCodex
A PHP source-code audit for authentication, authorization, security configuration, cryptography, and business logic. It covers credential and token weaknesses, access-control errors, unsafe settings, weak cryptography, and logic flaws.
Skill Claude CodeCodex
A method for evaluating whether multiple PHP security flaws can be combined into a complete attack path. It also includes scanning Composer packages for known dependency vulnerabilities.