Web Security skills

Exploiting WebSocket Vulnerabilities

mukul975

Test WebSocket implementations for security flaws.

Exploiting Server-Side Request Forgery

mukul975

Identify and exploit SSRF vulnerabilities securely.

Exploiting Template Injection Vulnerabilities

mukul975

Detect and exploit SSTI vulnerabilities in web applications.

Exploiting OAuth Misconfiguration

mukul975

Identify and exploit OAuth misconfigurations effectively.

Exploiting Insecure Deserialization

mukul975

Identify and exploit deserialization vulnerabilities in applications.

Exploiting Type Juggling Vulnerabilities

mukul975

Identify and exploit PHP type juggling vulnerabilities.

Exploiting SQL Injection with sqlmap

mukul975

Detect and exploit SQL injection vulnerabilities effectively.

AWS WAF Configuration

aws

Easily configure AWS WAF for web traffic filtering.

Web Application Logging with ModSecurity

mukul975

Configure ModSecurity for effective web application logging.

Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.

Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authentication bypass, data extraction, and unauthorized access via crafted query operators. Use when pentesting APIs or web applications backed by NoSQL databases to test input validation and injection defenses.

Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.

Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.

Comprehensive OWASP-aligned security guidance across six standards - Top 10 (2021) for web apps, ASVS 5.0, MASVS v2.1.0 for mobile, API Security Top 10 (2023), Kubernetes Top 10 (2022), and the Agentic Applications 2026 edition for AI/LLM. Use for security reviews, vulnerability audits, secure auth/crypto/access-control implementation, Kubernetes manifest hardening, and LLM/agent prompt-injection defense - including indirect requests like "is this login flow secure?", "review this endpoint", or "audit my pod spec".