[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:sce6":3,"skills:pro6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:110:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",1,39458,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",13274,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,828772,"2026-11-13 04:10:52",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":191},196852,{"records":196,"total":194,"current":555,"size":556},[197,243,264,287,304,324,339,355,377,393,414,431,450,466,480,499,516,533],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":221,"publishedAt":242},"01M6AEQN6KWABX8ZW3T36QZRA7","exploiting-sql-injection-vulnerabilities","Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-sql-injection-vulnerabilities\u002FSKILL.md",[211,214,217,220],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241],"vulnerabilities","sql","injection","exploiting sql injection vulnerabilities","testing","oracle","cybersecurity","assessment","code","authentication","verification","database","mysql","postgresql","data","t1078","database-security","SQL-injection","sqlmap","OWASP-A03","2026-11-10 10:12:30",{"skillNo":244,"name":245,"nameZh":13,"description":246,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":242},"01M6AEQHXYN0W1JVXDQVMNFRBY","exploiting-smb-vulnerabilities-with-metasploit","Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-smb-vulnerabilities-with-metasploit\u002FSKILL.md",[249],{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[222,251,252,253,254,228,255,256,231,257,258,259,260,261,262,263],"Metasploit","smb","exploiting smb vulnerabilities with metasploit","security","windows","pr","protocol","framework","Enterprise","network","network-security","exploitation","eternalblue",{"skillNo":265,"name":266,"nameZh":13,"description":267,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":268,"categories":269,"keywords":273,"publishedAt":242},"01M6AEQE1RGFQAQT64A29G0J15","exploiting-server-side-request-forgery","Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-server-side-request-forgery\u002FSKILL.md",[270,271,272],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[274,275,226,254,228,222,276,256,277,278,279,280,260,281,282,237,283,284,285,286],"server","exploiting server side request forgery","web","cloud","services","cloud-security","penetration-testing","ssrf","owasp","web-application-security","t1059","web-security","burpsuite",{"skillNo":288,"name":289,"nameZh":13,"description":290,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":291,"categories":292,"keywords":294,"publishedAt":242},"01M6AEQA3DX7AJ78ZZ252C0DP5","exploiting-race-condition-vulnerabilities","Detects and exploits race condition (TOCTOU) vulnerabilities in web applications using Burp Suite's Turbo Intruder extension and its single-packet attack technique to fire parallel requests that bypass rate limits, duplicate transactions, or overrun usage limits. Use when pentesting endpoints with balances, coupon redemption, or rate limiting that concurrent requests might manipulate.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-race-condition-vulnerabilities\u002FSKILL.md",[293],{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[222,295,254,228,276,256,296,283,284,297,298,299,300,301,302,303],"exploiting race condition vulnerabilities","pentesting","race-condition","turbo-intruder","toctou","concurrency","single-packet-attack","limit-overrun","burp-suite",{"skillNo":305,"name":306,"nameZh":13,"description":307,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":308,"categories":309,"keywords":312,"publishedAt":242},"01M6AEQ69FVEPCSTSZRQKT0T73","exploiting-prototype-pollution-in-javascript","Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through property injection into Object.prototype. Use when assessing a JavaScript\u002FNode.js application for prototype pollution, especially where a merge, clone, or extend function accepts user-controlled keys.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-prototype-pollution-in-javascript\u002FSKILL.md",[310,311],{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[313,314,315,228,222,276,316,256,231,274,283,284,224,317,318,319,320,321,322,323],"prototype","javascript","exploiting prototype pollution in javascript","merge","rce","prototype-pollution","node-js","xss","property-injection","dom-xss","server-side-pollution",{"skillNo":325,"name":326,"nameZh":13,"description":327,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":328,"categories":329,"keywords":333,"publishedAt":242},"01M6AEQ2NB5BCFDJ171NKS5GJM","exploiting-oauth-misconfiguration","Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-oauth-misconfiguration\u002FSKILL.md",[330,331,332],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":52,"categoryName":55,"taxonomyType":53,"taxonomyTypeDesc":54},[334,335,226,254,228,276,256,336,230,231,280,337,338,283,284,285],"OAuth","exploiting oauth misconfiguration","connect","authorization","oidc",{"skillNo":340,"name":341,"nameZh":13,"description":342,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":343,"categories":344,"keywords":348,"publishedAt":242},"01M6AEPYTFSS5KVEHB1P7JB3N2","exploiting-nosql-injection-vulnerabilities","Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authentication bypass, data extraction, and unauthorized access via crafted query operators. Use when pentesting APIs or web applications backed by NoSQL databases to test input validation and injection defenses.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nosql-injection-vulnerabilities\u002FSKILL.md",[345,346,347],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[222,224,349,350,226,254,228,256,231,233,236,351,296,283,284,285,352,353,354,238],"nosql","exploiting nosql injection vulnerabilities","authentication-bypass","nosql-injection","mongodb","injection-attack",{"skillNo":356,"name":357,"nameZh":13,"description":358,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":359,"categories":360,"keywords":362,"publishedAt":242},"01M6AEPTDNB3ND9ES3N2CXPNB9","exploiting-nopac-cve-2021-42278-42287","Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-nopac-cve-2021-42278-42287\u002FSKILL.md",[361],{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[363,364,365,228,230,232,366,367,368,369,370,371,372,296,237,284,373,374,375,376],"cve","exploiting nopac cve 2021 42278 42287","directory","monitoring","red-team","active-directory","privilege-escalation","escalation","dcsync","Impacket","domain-escalation","nopac","cve-2021-42278","cve-2021-42287",{"skillNo":378,"name":379,"nameZh":13,"description":380,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":381,"categories":382,"keywords":385,"publishedAt":242},"01M6AEPPVE76RKQFNS221NXTSV","exploiting-ms17-010-eternalblue-vulnerability","Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue\u002Fms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-ms17-010-eternalblue-vulnerability\u002FSKILL.md",[383,384],{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":52,"categoryName":55,"taxonomyType":53,"taxonomyTypeDesc":54},[386,228,255,230,366,274,367,387,388,260,389,390,251,262,252,237,391,284,263,392],"exploiting ms17 010 eternalblue vulnerability","post-exploitation","mitre-attack","adversary-simulation","Nmap","execution","remote-code-execution",{"skillNo":394,"name":395,"nameZh":13,"description":396,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":397,"categories":398,"keywords":403,"publishedAt":242},"01M6AEPJTV0WKT74R55WTF19A7","exploiting-mass-assignment-in-rest-apis","Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create\u002Fupdate requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-mass-assignment-in-rest-apis\u002FSKILL.md",[399,400,401,402],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":52,"categoryName":55,"taxonomyType":53,"taxonomyTypeDesc":54},[404,405,226,228,276,256,406,407,369,408,370,282,409,283,284,224,410,411,412,413],"REST","exploiting mass assignment in rest apis","create","update","api-security","mass-assignment","rest-api","autobinding","parameter-injection","owasp-api",{"skillNo":415,"name":416,"nameZh":13,"description":417,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":418,"categories":419,"keywords":420,"publishedAt":242},"01M6AEPF89VBX2GCAKN8KWSW6C","exploiting-kerberoasting-with-impacket","Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4\u002FAES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002FSKILL.md",[],[372,421,422,365,228,257,423,274,367,424,368,260,425,426,427,428,429,237,284,430],"kerberoasting","exploiting kerberoasting with impacket","offline","credential-access","service-accounts","kerberos","ATT&CK","t1558","t1003","t1558-003",{"skillNo":432,"name":433,"nameZh":13,"description":434,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":435,"categories":436,"keywords":441,"publishedAt":242},"01M6AEPBBRXKWG7KTKHA5X49T6","exploiting-jwt-algorithm-confusion-attack","Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid\u002Fjku\u002Fx5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-jwt-algorithm-confusion-attack\u002FSKILL.md",[437,438,439,440],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":52,"categoryName":55,"taxonomyType":53,"taxonomyTypeDesc":54},[442,226,254,228,443,256,232,444,274,408,445,284,446,447,448,449],"exploiting jwt algorithm confusion attack","auth","library","t1055","jwt","algorithm-confusion","token-forgery","cryptographic-attack",{"skillNo":451,"name":452,"nameZh":13,"description":453,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":454,"categories":455,"keywords":458,"publishedAt":242},"01M6AEP6ZCXBP7BZRQTFCM5086","exploiting-ipv6-vulnerabilities","Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-ipv6-vulnerabilities\u002FSKILL.md",[456,457],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[222,459,254,228,460,256,260,261,461,462,463,464,465],"exploiting ipv6 vulnerabilities","test","tunneling","ipv6","slaac","router-advertisement","dual-stack-security",{"skillNo":467,"name":468,"nameZh":13,"description":469,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":470,"categories":471,"keywords":474,"publishedAt":242},"01M6AEP369QQ9J8HK0R815BHVJ","exploiting-insecure-deserialization","Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-insecure-deserialization\u002FSKILL.md",[472,473],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[475,226,476,254,228,222,276,256,230,477,280,282,283,391,284,285,478,317,479],"exploiting insecure deserialization","python","java","deserialization","ysoserial",{"skillNo":481,"name":482,"nameZh":13,"description":483,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":484,"categories":485,"keywords":489,"publishedAt":242},"01M6AENYTW0YWEJYHR56KNY9S0","exploiting-insecure-data-storage-in-mobile","Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain\u002Fkeystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-insecure-data-storage-in-mobile\u002FSKILL.md",[486,487,488],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[490,236,491,226,492,228,222,256,229,493,494,495,496,497,280,282,262,237,284,498],"storage","exploiting insecure data storage in mobile","android","penetration testing","compliance","mobile-security","ios","owasp-mobile","data-storage",{"skillNo":500,"name":501,"nameZh":13,"description":502,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":503,"categories":504,"keywords":507,"publishedAt":242},"01M6AENVCD3WNSE0JF8Q8018X6","exploiting-idor-vulnerabilities","Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-idor-vulnerabilities\u002FSKILL.md",[505,506],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[222,508,509,226,228,460,276,510,511,256,512,280,513,282,514,515,283,284,285,286],"idor","exploiting idor vulnerabilities","sessions","validate","proxy","access-control","ids","bug bounty",{"skillNo":517,"name":518,"nameZh":13,"description":519,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":520,"categories":521,"keywords":524,"publishedAt":242},"01M6AENQYNAY44F35C1NE7AGDY","exploiting-http-request-smuggling","Detects and exploits HTTP request smuggling caused by Content-Length\u002FTransfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002FSKILL.md",[522,523],{"categoryNo":212,"categoryName":213,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},[525,526,226,254,228,276,256,527,512,528,529,530,280,282,283,284,531,532,285,286],"http","exploiting http request smuggling","content","cdn","encoding","transfer","request-smuggling","http-desync",{"skillNo":534,"name":535,"nameZh":13,"description":536,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":537,"categories":538,"keywords":546,"publishedAt":242},"01M6AENMAWXK35KBGF8522Z57B","exploiting-excessive-data-exposure-in-api","Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-excessive-data-exposure-in-api\u002FSKILL.md",[539,542,543,544,545],{"categoryNo":540,"categoryName":541,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":215,"categoryName":216,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":218,"categoryName":219,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":52,"categoryName":55,"taxonomyType":53,"taxonomyTypeDesc":54},{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[236,547,548,254,228,549,256,550,408,282,404,551,284,552,553,554],"exploiting excessive data exposure in api","frontend","debug","ui","endpoint","data-exposure","rest-security","pii-leakage",110,18]