HACKING SKILLS / HackSkills

Overview

This is a top-level routing skill for bug bounty, web security, API security, and authorized penetration testing.

Its core role is not to replace all specialized techniques, but to help the agent:

1. First determine the testing phase (Recon / Validation / Privilege Escalation / Chain building)
2. Then select the correct vulnerability category
3. Avoid relying only on baseline model memory; prefer structured methodology
4. Prioritize boundary conditions AI often misses but that matter in real engagements

Trust Model

• This knowledge base emphasizes content safety and auditability.
• Use this only within authorized targets, legitimate research, defensive validation, and bug-bounty-approved rules.
• Do not use these techniques for unauthorized attacks.

When to Use This Skill

Use this skill first in the following scenarios:

• You just received a new bug bounty target and do not know where to start
• You need to decide whether to load XSS / SQLi / SSRF / IDOR / JWT / API tracks first
• You want the agent to perform Web/API security testing with a more stable methodology
• You need to route scattered findings to the right attack surface
• You want AI to miss fewer critical test points in security work

Operating Model

Step 1: Start with Recon and context validation

Collect first:

• Target type: classic web, REST API, mobile backend, admin panel, payment flow, file upload, GraphQL
• Identity and permission model: anonymous, regular user, admin, multi-tenant
• Input locations: URL, query parameters, JSON, headers, cookies, filenames, imported files, templates, reflection points
• Output locations: HTML, attributes, JS, PDF, email, logs, background tasks, mobile endpoints

Step 2: Route by observed behavior