978 skills found ¡ Page 19 of 33
elementalsouls / osint-autopilotEnd-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain â engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generateâĻ
elementalsouls / continuous-exposure-monitoringTurns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute tabâĻ
elementalsouls / email-domain-securityRigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered compoâĻ
supabase / supabaseUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWTâĻ
yaklang / xss-cross-site-scriptingAlso load SCENARIOS.md when you need: - Django debug page XSS (CVE-2017-12794) â duplicate key error â unescaped exception â XSS - UTF-7 XSS for legacy IE environments (`+ADw-script+AD4-`) - HttpOnly bypass methodology â proxy-the-browser, session riding, CSRF-via-XSS - XS-Leaks side channel attacksâĻ
yaklang / xxe-xml-external-entityAlso load SCENARIOS.md when you need: - Apache Solr XXE + RCE chain (CVE-2017-12629) â XXE to read config, then VelocityResponseWriter for RCE - Office docx XXE step-by-step â unzip â inject DOCTYPE into `word/document.xml` or `[Content_Types].xml` â repackage â upload - DOCTYPE-based blind SSRF â `âĻ
yaklang / linux-lateral-movementLinux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.
yaklang / prototype-pollution-advancedAdvanced prototype pollution playbook â server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics
yaklang / ssrf-server-side-request-forgeryAlso load SCENARIOS.md when you need: - WebLogic SSRF (CVE-2014-4210) â `uddiexplorer/SearchPublicRegistries.jsp` + `operator` parameter + `%0D%0A` CRLF to inject Redis commands - SSRF â internal Redis â write crontab reverse shell complete payload chain - DNS Rebinding deep dive â TTL=0 trick, initâĻ
yaklang / ghost-bits-cast-attackJava "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026)
yaklang / websocket-securityWebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws
yaklang / ssti-server-side-template-injectionBefore using full engine-specific exploitation, you can first load:
yaklang / arbitrary-write-to-rceArbitrary write to RCE playbook
yaklang / business-logic-vulnerabilitiesBusiness logic vulnerability playbook
yaklang / csp-bypass-advancedAdvanced Content Security Policy bypass techniques
yaklang / kubernetes-pentestingKubernetes penetration testing playbook
yaklang / macos-process-injectionmacOS process injection playbook
yaklang / macos-security-bypassmacOS security bypass playbook
yaklang / path-traversal-lfiPath traversal and LFI playbook
yaklang / race-conditionRace condition and TOCTOU testing for web apps
yaklang / symmetric-cipher-attacksSymmetric cipher attack playbook
yaklang / active-directory-acl-abuseActive Directory ACL abuse playbook
yaklang / binary-protection-bypassBinary protection bypass playbook
yaklang / browser-exploitation-v8Browser and V8 exploitation playbook
yaklang / format-string-exploitationFormat string exploitation playbook
yaklang / http2-specific-attacksHTTP/2 protocol-specific attack playbook
yaklang / kernel-exploitationLinux kernel exploitation playbook
yaklang / linux-privilege-escalationLinux privilege escalation playbook
yaklang / linux-security-bypassLinux security mechanism bypass playbook
yaklang / network-protocol-attacksNetwork protocol attack playbook
