12,321 skills found · Page 261 of 411
uphiago / cms-detectionIdentify CMS, frameworks, and server technology stacks on live hosts.
uphiago / exchange-owa-attackExchange/OWA NTLM AD leak, spray attack when mail subdomain.
uphiago / flask-werkzeug-attackExploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
uphiago / github-secret-huntingFind leaked API keys, tokens, and credentials in public GitHub repositories.
uphiago / hardcoded-credential-huntDetect hardcoded passwords in HTML forms, JavaScript, and API responses.
uphiago / http2-header-impersonationSpoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
uphiago / humanize-automationHuman-like mouse, keyboard and scroll behavior for behavioral bot bypass.
uphiago / js-secrets-extractionAnalyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
uphiago / origin-ip-discoveryDiscover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
uphiago / port-service-discoveryNmap scan for MySQL, Redis, FTP, SSH, internal API services.
uphiago / s3-minio-content-type-xssExploit public bucket Content-Type override for stored XSS on target origin.
uphiago / scada-hikvision-isapiEnumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.
uphiago / stealth-browser-launchLaunch stealth Chromium with C++ fingerprint patches for anti-bot bypass.
uphiago / tls-fingerprint-impersonationSpoof TLS ClientHello and JA4 fingerprints for browser impersonation.
uphiago / unauth-api-flow-hijackExploit unauthenticated multi-step API flows without credentials.
uphiago / visual-reconScreenshot all live hosts for rapid visual triage and technology fingerprinting.
uphiago / web-enumerationSensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
uphiago / cloud-iam-deepGCP/AWS/Azure cloud exploitation -- Cloud Functions, Firestore, Cloud Run, S3, MinIO, Blob Storage, SA keys
uphiago / hunt-broken-function-level-authHunt broken function-level authorization via verb drift, route shadowing, and transport gaps.
uphiago / hunt-fastapiHunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.
uphiago / hunt-information-disclosureHunt error leakage, DVCS exposure, source maps, config files, and differential oracles.
uphiago / hunt-mass-assignmentHunt mass assignment via sensitive field injection and ORM framework exploitation.
uphiago / hunt-mcp-securityHunt Model Context Protocol (MCP) vulnerabilities in AI-tool integration systems.
uphiago / hunt-nestjsHunt NestJS-specific vulnerabilities: guard bypass, decorator gaps, and microservice auth drift.
uphiago / hunt-prototype-pollutionHunt client-side and server-side prototype pollution for XSS, auth bypass, and RCE.
uphiago / hunt-schema-enumerationEnumerate hidden tables, fields, and endpoints via API error hints. Agnostic across PostgREST, Zod, FastAPI, GraphQL, and REST.
uphiago / pentest-playbook7-phase pentest pipeline from passive recon to exploitation.
uphiago / google-dorks-catalogHigh-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated
uphiago / subdomain-takeover-huntDetect and verify subdomain takeover via dangling CNAME to unclaimed services.
uphiago / vhost-enumerationDiscover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
