skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

fast-checking

Applies a rapid offensive security checklist for time-boxed web application and infrastructure assessments.

Updated Jun 26, 2026
Search Tags:#vulnerability assessment#penetration testing#reconnaissance#web security#ctf#offensive security#security checklist
One-click install
npx skills add https://github.com/brukal001/brukal --skill fast-checking-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fast-checking
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/utility/offensive-fast-checking
Command: npx skills add https://github.com/brukal001/brukal --skill fast-checking-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers working under tight time constraints need a structured, speed-optimized methodology to quickly map attack surfaces and find quick-win vulnerabilities without missing critical checks. ## Core Features & Use Cases - Rapid Recon & Surface Mapping: Fast reconnaissance shortcuts including content discovery, technology fingerprinting, origin IP identification behind CDN/WAF, and API contract capture. - Comprehensive Vulnerability Checklists: Ordered test items covering authentication, session handling, access controls (IDOR/BOLA/BFLA), injection flaws, file uploads, business logic, API security (GraphQL, OAuth, JWT), cloud misconfigurations, HTTP request smuggling, and AI/LLM integration testing. - Use Case: During a time-boxed CTF engagement or initial assessment, activate this skill to walk through triage shortcuts and scanner configurations, tracking completed checklist items and suggesting next steps based on findings. ## Quick Start Run a fast security assessment checklist against the target application and prioritize quick-win vulnerability checks.

Frequently Asked Questions about fast-checking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a fast web application security assessment?▼

Follow a speed-optimized checklist that starts with rapid recon (content mapping, technology fingerprinting, hidden content discovery), then moves through authentication, session, injection, and access control tests in priority order. Track completed items and escalate based on findings.

What should a penetration testing checklist cover?▼

A thorough checklist covers reconnaissance, authentication and session handling, access controls (IDOR, BOLA, BFLA), input validation (SQLi, XSS, SSTI, XXE), file uploads, business logic, API security (GraphQL, OAuth, JWT), infrastructure and cloud misconfigurations, and emerging areas like LLM and WebSocket testing.

How do I find the origin IP behind a CDN or WAF?▼

Check historical DNS records, enumerate subdomains for dev or staging hosts, analyze SSL certificate SANs via Censys or Shodan, inspect email headers, then verify candidate IPs directly with curl --resolve and compare content, headers, and certificates.

Does this checklist cover API and GraphQL security testing?▼

Yes, it includes dedicated sections for REST, SOAP, and GraphQL testing, covering introspection queries, BOLA/IDOR in mutations, injection in arguments, denial of service via nested queries, plus OAuth flow and JWT-specific attacks like algorithm confusion and kid injection.

When should I use a fast checklist instead of a full methodology?▼

Use the fast checklist for time-boxed assessments, CTF engagements, or initial surface mapping where speed matters more than exhaustive depth. For comprehensive audits or compliance-driven tests, a full methodology with deeper manual verification is more appropriate.

Related Skills

Explore More Software Engineering Skills→
braydos-hbraydos-h
4

attacking-domains-end-to-end

Orchestrates domain reconnaissance, subdomain enumeration, DNS analysis, and web exploitation across an authorized attack surface.

Community
Advanced
damacusdamacus
2

security-reviewer

Review codebases for vulnerabilities and generate structured security audit reports.

Community
Advanced
dreadnodedreadnode
11

burp-suite

Automate Burp Suite Professional security testing via its MCP server.

Official
Intermediate
kalilurrahmankalilurrahman
1

security-testing

Designs security testing programs covering SAST, DAST, dependency scanning, and penetration testing.

Community
Advanced