skills.rest
dbx0
dbx0COMMUNITY
Explore all skills by this author →
WebsiteGitHub

offensive-security

Guides offensive security testing across web apps, APIs, source code audits, and ML infrastructure.

7|4|Updated Jun 22, 2026
Search Tags:#xss#penetration testing#code audit#api security#bug bounty#web exploitation#offensive security
One-click install
npx skills add https://github.com/dbx0/skills --skill offensive-security-dbx0
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-security
Source: https://github.com/dbx0/skills/tree/main/skills/methodology/mindset/offensive-security
Command: npx skills add https://github.com/dbx0/skills --skill offensive-security-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security testers and bug bounty hunters need a structured, repeatable methodology for finding vulnerabilities across diverse targets — SPAs, REST APIs, Next.js Server Actions, MCP servers, and cloud functions — without wasting time on false positives or missing undocumented attack surface. ## Core Features & Use Cases - Web & API Exploitation Methodology: Covers JS bundle mining for undocumented endpoints, Better Auth testing, internal API auth bypass patterns, CORS analysis, and business logic flaws like race conditions and negative values. - Source Code Audit Patterns: Provides 21 concrete vulnerability patterns from real audits (XPath injection, shell command concatenation, CSRF header bypasses, session fixation) with grep strategies for large codebases. - Specialized Testing References: Includes playbooks for email spoofing (SPF/DMARC), SVG file-upload XSS, Express path traversal, ComfyUI attack surface analysis, and anti-bot detection fallback strategies. - Use Case: During a bug bounty engagement against a Next.js SaaS, use the skill to extract Server Action IDs from the JS bundle, map internal API endpoints, test Better Auth endpoints for mass assignment, and document findings with proven report wording. ## Quick Start Load the offensive-security skill and ask it to plan and execute a bug bounty test against my in-scope target, starting with recon and JS bundle analysis.

Frequently Asked Questions about offensive-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find undocumented API endpoints in a React or Next.js app?▼

Download the minified JS bundle and grep for path patterns like /api/, /v1/, and /internal/ to extract every endpoint the frontend calls. For Next.js Server Actions, search for createServerReference calls and capture Next-Action header IDs via a fetch interceptor.

How do I test Better Auth endpoints for vulnerabilities?▼

Identify Better Auth via the __Secure-better-auth.session_token cookie or better-auth imports in the JS bundle, then test standard endpoints like /api/auth/update-user for mass assignment and sign-in/social for exposed OAuth client IDs. Always include the Origin header on state-changing requests or you will get a 403.

When is a CORS misconfiguration actually exploitable?▼

CORS is exploitable when ACAO reflects an arbitrary Origin with ACAC true, uses null origin, or pairs with a subdomain takeover. The common ACAO wildcard plus ACAC true combination is blocked by modern browsers and is a frequent false positive.

Why is my SVG XSS payload not executing in the browser?▼

Modern browsers block all script execution in SVGs loaded via img tags. Test whether the SVG can be opened directly in a new tab, embedded via iframe or object, or served without Content-Disposition attachment, since those contexts execute scripts.

What should I do when browser automation gets detected by anti-bot systems?▼

Confirm the wall with at most two different approaches, then stop retrying and switch to direct API calls using request formats extracted from the JS bundle. If both browser and API are blocked, escalate to the user with alternatives like screenshots or proxy routing.

How do I approach auditing a large codebase with thousands of files?▼

Prioritize entry points, auth flow, and dangerous function sinks like exec, eval, and unserialize using grep, then manually trace only reachable paths. Search for bare keywords like PublicPage rather than annotation-specific forms to catch both PHPDoc and PHP 8 attribute variants.

Related Skills

Explore More Software Engineering Skills→
valITinovalITino
7

recon-deep

Automate comprehensive reconnaissance to map a target's attack surface.

Community
Advanced
Ap6packAp6pack
4

report-template

Converts security findings into formatted bug bounty submissions and client engagement reports.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced
DhumitechDhumitech

security-auditor

Identify and remediate security vulnerabilities across codebases, architectures, and deployments.

Community
Advanced