Best penetration testing skills, page 4

Attack and enumerate Azure AD / Entra ID tenants — initial recon with AADInternals and ROADtools, password spraying, token theft (PRT, CAE, refresh tokens), application and service principal abuse…

trilwu/secskills

Prioritize and drive remediation of a vulnerability backlog by real risk, not raw CVSS — combining severity with exploitation signals (EPSS, CISA KEV), asset exposure and business context, using…

trilwu/secskills

Write security findings and assessment reports — severity scoring with CVSS and business impact, reproducible proof of concept, remediation guidance, executive summaries, and coordinated disclosure.

trilwu/secskills

Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities.

trilwu/secskills

Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation.

blacklanternsecurity/red-run

Entry P0 primary router and operating doctrine for HackSkills.

yaklang/hack-skills

Coordinate a PCI DSS penetration-testing and CDE-scoping readiness assessment across methodology, scope, segmentation, execution evidence, remediation, and retesting.

cyberful/cyberful

Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform

Hack23/cia

HTTP request smuggling via CL.TE/TE.CL desync and cache poisoning

NeoTheCapt/RedteamAgent

Frontend source code analysis for hidden routes, API endpoints, and secrets

NeoTheCapt/RedteamAgent

Detect and exploit SQL injection vulnerabilities in web application parameters

NeoTheCapt/RedteamAgent

Detect and exploit server-side request forgery to access internal resources and cloud metadata

NeoTheCapt/RedteamAgent

Subdomain discovery via subfinder, DNS brute-force, and passive sources

NeoTheCapt/RedteamAgent

Discover any interface (HTTP, WebSocket, GraphQL, gRPC, or other) that distinguishes between existing and non-existing users through any observable difference

NeoTheCapt/RedteamAgent

Enumerate web technologies, headers, endpoints, and metadata from a target

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

NeoTheCapt/RedteamAgent

XML external entity injection for file read, SSRF, and DoS. An agent skill from NeoTheCapt/RedteamAgent.

NeoTheCapt/RedteamAgent

Build or challenge an application threat model from architecture, dataflows, identities, trust boundaries, business invariants, dependencies, and deployment context.

cyberful/cyberful

Audit C, C++, unsafe Rust, native extensions, parsers, codecs, FFI boundaries, and systems code for memory corruption and low-level exploitation risk.

cyberful/cyberful

Operate Cyberful as an authorized application-security control room.

cyberful/cyberful

Bypass antivirus and EDR detection for payload delivery during exploitation.

blacklanternsecurity/red-run

Host discovery and port scanning using nmap — ICMP/ARP host discovery, SYN/TCP/UDP port scanning with scope enforcement and audit logging.

automateyournetwork/netclaw

Custom nmap scans with arbitrary flags, plus scan history retrieval and management.

automateyournetwork/netclaw

Service fingerprinting, OS detection, NSE script execution, and vulnerability scanning using nmap MCP.

automateyournetwork/netclaw

Analyze detected vulnerabilities to assess realistic exploitability by examining control flow, input sources, sanitization logic, and execution context.

ArabelaTso/Skills-4-SE

Assess AI-system risk from architecture, intended use, affected actors, model limitations, data lineage, autonomy, human oversight, monitoring, and failure consequences.

cyberful/cyberful

使用 naabu 进行高速端口扫描。当需要对目标主机/网段进行端口发现、存活检测时使用。naabu 是 ProjectDiscovery 出品的快速端口扫描器，支持 SYN/CONNECT/UDP 扫描，性能远超 nmap，支持批量目标、CDN 排除、nmap 集成。任何涉及端口扫描、端口发现、主机存活检测、网段探测的场景都应使用此技能。如果 naabu 结果不足再降级用 nmap

wgpsec/AboutSecurity

使用 nmap 进行端口扫描和服务识别。当需要对目标进行精细端口扫描、服务版本探测、操作系统指纹识别、NSE 脚本漏洞扫描时使用。nmap 是最经典的网络扫描器，支持 SYN/TCP/UDP/ACK 等多种扫描模式，内置 600+ NSE 脚本。任何涉及端口扫描、服务识别、漏洞脚本扫描、操作系统指纹的场景都应使用此技能。速度不如 naabu，但功能远超 naabu

wgpsec/AboutSecurity

Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts

NeoTheCapt/RedteamAgent

OS command injection detection, exploitation, and filter bypass

NeoTheCapt/RedteamAgent

File upload vulnerability testing — webshells, bypass, path traversal

NeoTheCapt/RedteamAgent

Insecure direct object reference testing for broken access control

NeoTheCapt/RedteamAgent

Information disclosure detection — error messages, files, headers, debug endpoints

NeoTheCapt/RedteamAgent

Server-side template injection detection, engine identification, and RCE

NeoTheCapt/RedteamAgent

Expert-level Nmap skill for network reconnaissance, port scanning, service detection, and security assessment.

theneoai/awesome-skills

Elite Security Engineer skill with deep expertise in application security, cloud security architecture, penetration testing, Zero Trust implementation, threat modeling (STRIDE), and compliance…

theneoai/awesome-skills

Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan

vibeeval/vibecosystem

API security expertise covering OWASP API Security Top 10, API authentication and authorization patterns, API key management, rate limiting and throttling, JWT security best practices, OAuth 2.0…

FerroxLabs/wayland

Becomes a senior DevOps engineer who designs and implements CI/CD pipelines, infrastructure as code, monitoring systems, and deployment strategies.

FerroxLabs/wayland