security-arsenal

Provides payloads, bypass tables, and wordlists for web vulnerability testing.

Updated Sep 6, 2026
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill security-arsenal-inventashif
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-arsenal
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/security-arsenal
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill security-arsenal-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bug bounty hunters and penetration testers waste time recalling or reconstructing the correct payload syntax for each vulnerability class, and risk submitting findings that programs always reject, hurting their validity ratio. ## Core Features & Use Cases - Payload Library: Ready-to-use payloads for XSS, SSRF, SQLi, XXE, NoSQLi, command injection, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket attacks, MFA bypass, and SAML attacks. - Submission Triage Tables: An always-rejected list and a conditionally-valid-with-chain table that tell you which findings are reportable and which require a proven impact chain first. - Recon Integration: gf pattern names, wordlist references, and built-in paths for fuzzing sensitive files, admin panels, and API endpoints. - Use Case: While testing a search parameter that reflects input, load the XSS section to get polyglot and CSP-bypass payloads, confirm reflection with a unique marker string, then check the triage tables before writing the report. ## Quick Start Ask the AI to give you SSRF bypass payloads for a target running on AWS, including cloud metadata endpoints and IP obfuscation techniques.

Frequently Asked Questions about security-arsenal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for SSRF vulnerabilities in cloud environments?

SSRF testing targets cloud metadata endpoints like http://169.254.169.254 for AWS, GCP, and Azure. Use IP bypass payloads such as decimal (2130706433), octal, hex, or IPv6 loopback forms when filters block standard addresses, and confirm blind SSRF with an out-of-band DNS callback.

What payloads bypass WAF rules for SQL injection?

SQL injection WAF bypasses include MySQL inline comments (/*!50000 SELECT*/), comment injection between keywords, case variation, URL encoding, and Unicode apostrophes. Try encoding tricks first, then parser quirks, since most WAFs fail when they and the origin app parse requests differently.

Which bug bounty findings are always rejected by programs?

Always-rejected findings include missing security headers, SPF/DKIM/DMARC issues, self-XSS, logout CSRF, clickjacking without sensitive actions, open redirects without an ATO chain, and rate limiting on non-critical forms. Submitting these hurts your validity ratio, so check the rejection list before reporting.

How do I confirm blind SQL injection without false positives?

Confirm blind SQLi with out-of-band callbacks via Burp Collaborator or interactsh, since error messages alone can be unrelated parser logs. For timing-based detection, run at least 10 interleaved trials and require a Welch's t-statistic above 3 to separate signal from noise.

Do classic HTTP request smuggling payloads still work on modern servers?

Classic CL.TE and TE.CL smuggling payloads no longer work against Nginx 1.21+, Caddy 2.x, or Envoy 1.20+, but remain effective against HAProxy 2.4 and older, F5 BIG-IP, Citrix ADC, and some AWS ALB configurations. Fingerprint the front-end server before attempting desynchronization attacks.