vigilantshield/Claude-HunterKit

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Tool output secrets, API key exfiltration, environment variable disclosure, credential harvesting via tool chains.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII…

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API specification ingestion and attack surface mapping skill. Covers OpenAPI/Swagger parsing, endpoint enumeration, authentication scheme detection, parameter discovery, and API documentation analysis for security testing. Use when beginning API security assessment.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API documentation leakage testing skill. Covers exposed Swagger/OpenAPI endpoints, debug endpoints, internal API documentation, GraphQL introspection, and sensitive information in API responses. Use when searching for unintended API documentation exposure.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API authentication profiling: detect and catalog all auth mechanisms (JWT, OAuth2, API keys, Basic, Digest, mTLS, session cookies, HMAC, custom schemes) across API endpoints. Maps auth requirements per path and feeds downstream auth-attack sub-agents.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Broken Object Level Authorization (BOLA) testing: object ID enumeration in REST/GraphQL/gRPC, horizontal/vertical privilege escalation, UUID prediction, mass assignment via extra parameters, and indirect reference manipulation. API-specific variant of IDOR. Use when testing API authorization.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API authentication attack testing: credential stuffing, rate-limit bypass via IP rotation, token reuse/replay, JWT manipulation in API context, OAuth token interception, and multi-factor auth bypass. Use when testing API authentication security.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API mass assignment testing: privileged field injection via JSON/XML body, nested object manipulation, API version differentials, hidden parameter discovery, and framework-specific autobinding bypass. Use when testing APIs with automatic model binding.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Broken Function Level Authorization (BFLA) testing: horizontal/vertical function access, admin endpoint enumeration, HTTP method bypass, role confusion via header manipulation, and GraphQL mutation access control. Use when testing API authorization for privileged functions.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Advanced BOLA/IDOR techniques: batch/parallel enumeration, side-channel detection via response timing, CDN cache-key probing, gRPC/protobuf ID manipulation, and bulk data export abuse. Use when basic BOLA tests are blocked by WAF or rate limits.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Multi-tenant isolation testing: cross-tenant data access via IDOR/BOLA, tenant ID manipulation in JWT/headers/body, SSRF between tenant partitions, shared resource contention, and cloud tenancy boundary bypass. Use when testing SaaS/cloud API multi-tenant architectures.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL…

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API NoSQL injection testing: MongoDB operator injection ($ne, $gt, $regex, $where), blind NoSQL via $regex character extraction, JSON body injection in REST APIs, and GraphQL NoSQLi via filter arguments. Use when testing APIs using MongoDB or other NoSQL databases.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

XML External Entity injection testing checklist: classic XXE, blind XXE (out-of-band), XXE via file upload (SVG/docx), XXE in SOAP/REST, error-based XXE, XInclude attacks, and XXE filter bypass. Use for web app XXE testing and bug bounty.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Insecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

API specification injection: parameter pollution via spec-defined fields, content-type switching (JSON→XML→form), UTF-8 BOM parser bypass, schema validation bypass via extra fields, and type confusion in auto-generated API clients. Use when testing APIs with strict schema validation.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Test gRPC API security — protobuf fuzzing, BOLA/BFLA in RPC methods, missing authentication, reflection service abuse, metadata header injection, and TLS misconfiguration in gRPC services.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

WebSocket API security testing: missing Origin validation, CSWSH, message tampering, auth bypass via WS upgrade, subscription IDOR, and rate-limit bypass over persistent connections.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

WebSocket protocol-level attacks: subprotocol negotiation bypass, WS->HTTP smuggling, ping/pong flood DoS, continuation frame DoS, and compression bomb via permessage-deflate.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Message queue security testing skill. Covers AMQP/RabbitMQ, Kafka, Redis Pub/Sub, and MQTT injection, queue poisoning, message replay, and authorization bypass in message broker systems. Use when testing message queue integrations.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Server-Sent Events (SSE) security testing: event stream interception, cross-origin SSE via CORS misconfig, connection injection, and data leakage via event ID enumeration.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Mutual TLS (mTLS) security testing skill. Covers certificate validation bypass, client certificate spoofing, mTLS downgrade attacks, and certificate pinning bypass. Use when testing mTLS implementations.

vigilantshield/Claude-HunterKit

Skill Claude CodeCodex

Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows…