yaklang · Agent Skills

103 skills with substantive source documentation and an official publisher or observed installation demand. Read each skill’s original documentation through its card.

yaklang

Community

symmetric-cipher-attacks

Symmetric cipher attack playbook. Use when exploiting block cipher mode weaknesses (CBC padding oracle, ECB cut-and-paste, bit flipping), stream cipher key reuse, or meet-in-the-middle attacks.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

traffic-analysis-pcap

Traffic analysis and PCAP forensics playbook. Use when analyzing network captures including Wireshark filters, protocol analysis (HTTP/DNS/FTP/SMTP/USB/WiFi), data extraction, covert channel detection, PCAP repair, TLS decryption, and tshark command-line analysis.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

type-juggling

PHP type juggling and weak comparison (==) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

upload-insecure-files

Insecure file upload playbook. Use when testing upload validation, storage paths, processing pipelines, preview behavior, overwrite risks, and upload-to-RCE chains.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

vm-and-bytecode-reverse

Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, dispatcher loops, or maze-style challenges.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

waf-bypass-techniques

WAF bypass methodology and generic evasion techniques. Use when a web application firewall blocks injection payloads (SQLi, XSS, RCE) and you need to craft bypasses using encoding, protocol-level tricks, or WAF-specific weaknesses.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

web-cache-deception

Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

websocket-security

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

windows-av-evasion

AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

windows-lateral-movement

Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

windows-privilege-escalation

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT3 File

Vedi dettagli →

yaklang

Community

xslt-injection

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

xss-cross-site-scripting

XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT3 File

Vedi dettagli →

yaklang

Community

xxe-xml-external-entity

XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.

installazioni

2

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

api-auth-and-jwt-abuse

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

api-recon-and-docs

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

business-logic-vuln

Entry P1 category router for business logic testing. Use when workflow abuse, race conditions, pricing flaws, or multi-step state attacks matter more than parser-level input injection.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

classical-cipher-analysis

Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

container-escape-techniques

Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT2 File

Vedi dettagli →

yaklang

Community

dangling-markup-injection

Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

expression-language-injection

Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

hash-attack-techniques

Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

jwt-oauth-token-attacks

JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT1 File

Vedi dettagli →

yaklang

Community

kernel-exploitation

Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commitcreds, modprobepath overwrite, or kernel ROP chains in CTF and real-world scenarios.

installazioni

1

GitHub Stars

2,5K

Aggiornato

13 set

MIT3 File

Vedi dettagli →