wgpsec/AboutSecurity

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding flaws in how web applications handle business processes such as payments, orders, accounts, and verification.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to testing web caches and proxy layers for cache poisoning and HTTP request smuggling. Cache poisoning stores an attacker-controlled response, while request smuggling exploits differences in how servers parse requests.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding and testing OS command injection, where user input is accidentally run as a command on the server.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to testing unsafe deserialization, where an application rebuilds data from an untrusted encoded value such as a cookie or request parameter.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to testing expression-language injection in frameworks such as Spring, Struts, Confluence, JSP, and JSF. Expression languages let applications evaluate specially formatted text as instructions.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to testing file-upload features for security weaknesses, including basic checks and methods for handling upload restrictions.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for GraphQL, a way for clients to request specific data from an API through queries.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for attacks that abuse the HTTP Host header, which tells a web server which hostname a request targets. It covers password resets, caching, redirects, reverse proxies, and virtual hosts.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for sensitive information disclosure, where an application or server unintentionally exposes files, source code, settings, or documentation. Examples include .git folders, backup archives, environment files, and debug pages.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for finding and exploiting unsafe Java object deserialization, where an application turns untrusted data back into Java objects. It covers common Java servers, frameworks, and protocols where this problem appears.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for LDAP injection, where crafted search filters alter how an LDAP directory looks up users. LDAP is a directory service commonly used for enterprise login systems and Active Directory.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for local file inclusion, remote file inclusion, and arbitrary file reading. These flaws let an application read or load files based on attacker-controlled input.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for NoSQL injection, where crafted JSON or query operators change how a document database searches for data. NoSQL databases include systems such as MongoDB and CouchDB.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to bypassing PHP security restrictions such as disabled functions and open_basedir. PHP is a server-side programming language; these settings limit command execution or file access.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for PHP type juggling, where loose comparisons treat different data types as equivalent. It also covers magic hashes, which are hash values that can trigger unsafe comparisons.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for raising privileges inside a web application. It examines whether ordinary users can alter roles, identity fields, sessions, cookies, headers, or request methods to reach restricted functions.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A security-testing guide for JavaScript prototype pollution, where untrusted input changes shared object behavior in a JavaScript application. It covers both server-side Node.js applications and browser-side code.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding and exploiting class pollution in Python web applications, where user-controlled data changes object attributes or application settings.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing exposed debug features in Python web applications. Debug mode shows detailed errors and may provide an interactive Python console or automatic API documentation.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to detecting and testing SQL injection, where crafted input changes a database query made by a website.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding server-side request forgery, or SSRF, where a website is tricked into making network requests on the user’s behalf.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding server-side template injection, where user input is inserted into a template and interpreted as template instructions instead of plain text.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to finding subdomains whose DNS records point to abandoned or unclaimed online services. Subdomain takeover means claiming that service so the subdomain serves content controlled by someone else.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to testing whether a web application firewall, or WAF, blocks and detects security-test requests. A WAF is a filter that sits in front of a website and rejects suspicious traffic.