murrtada
16 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.
murrtadabb-methodology
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadabugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-jwt-crypto
Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an eyJ... Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token t
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-mfa-bypass
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-open-redirect
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-spa-api
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely m
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-sqli
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/Couc
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-ssrf
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generat
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadahunt-subdomain
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps cloudapp.azure.com regional-pool re-issue (1-click OAuth ATO via wildcard replyto, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel cname.vercel-dns.com deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis o
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadameme-coin-audit
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadamid-engagement-ir-detection
Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and converting those observations into deliverable findings. Built from authorized red-team work where the client patched a confirmed SQLi within 30 minutes of detection AND an external attacker locked multiple new accounts during a single test session. Use when (a) running ANY active engagement against a monitored target, (b) a previously-confirmed finding stops
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadaredteam-mindset
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when scope is "external red team" not "bug bounty / WAPT".
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadaweb2-recon
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadaweb3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadaywh-rules
Always-on drafting discipline for YesWeHack bug bounty reports. Load this at the start of any report-writing / findings session. Never invent facts, never write theoretical impact, propose-don't-impose, PoC replayed from scratch, no boilerplate at scale, methodology guardrails, scope discipline.
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.
murrtadaywh-triage
Self-validates a YesWeHack bug bounty report draft before submission. Run on every draft. Returns a verdict (READY / NEEDS FIXES / DO NOT SUBMIT) with concrete fixes. Applies the AI-slop reference on every draft and the ywh-gotchas skill when a specific class is claimed.
- Installationen
- 1
- GitHub Stars
- 5
- Aktualisiert
- 26. Sept.