dreadnode/capabilities

dreadnode/capabilities · AGENTS.md

dreadnode/capabilities · CLAUDE.md

dreadnode/capabilities · capabilities/ai-red-teaming/skills/analytics-interpretation/SKILL.md · Guide for reading and interpreting AIRT analytics output including ASR, risk scores, severity, and compliance metrics

dreadnode/capabilities · capabilities/ai-red-teaming/skills/attack-selection-guide/SKILL.md · Decision tree for selecting AIRT attacks based on goals, target type, and constraints

dreadnode/capabilities · capabilities/ai-red-teaming/skills/auth-setup-guide/SKILL.md · Guide the user through authenticating the target, attacker, and judge models from their own environment (any cloud, any…

dreadnode/capabilities · capabilities/ai-red-teaming/skills/compliance-mapping/SKILL.md · Maps AIRT attacks, transforms, and scorers to OWASP LLM Top 10, OWASP ASI (ASI01-ASI10), MITRE ATLAS, NIST AI RMF, and…

dreadnode/capabilities · capabilities/ai-red-teaming/skills/error-troubleshooting/SKILL.md · Diagnose and fix common errors in AIRT attack generation, execution, and results collection

dreadnode/capabilities · capabilities/ai-red-teaming/skills/provisioning-and-lifecycle/SKILL.md · Provision a hosted target, pick the right endpoint per target type, tear down to stop billing, and interpret transient…

dreadnode/capabilities · capabilities/ai-red-teaming/skills/scorer-reference/SKILL.md · Complete catalog of all 84 scorers with exact names, categories, and when to use each

dreadnode/capabilities · capabilities/ai-red-teaming/skills/trace-analysis-advisor/SKILL.md · Analyzes historical attack traces to provide intelligent recommendations for attack selection, transform effectiveness…

dreadnode/capabilities · capabilities/ai-red-teaming/skills/transform-reference/SKILL.md · Complete catalog of all 183 transforms with exact names, parameters, categories, and LLM requirements

dreadnode/capabilities · capabilities/ai-red-teaming/skills/workflow-patterns/SKILL.md · Python workflow templates for common AIRT assessment scenarios using the Assessment API

dreadnode/capabilities · capabilities/analysis-ledger/skills/recursive-code-analysis/SKILL.md · Use when code analysis, vulnerability research, or architecture mapping needs a durable worklist that can resume across…

dreadnode/capabilities · capabilities/android-apk-research/skills/android-corpus-prep/SKILL.md · Use when preparing Android APK corpora — AndroZoo metadata download, popular-package selection via DuckDB, APK download…

dreadnode/capabilities · capabilities/android-apk-research/skills/android-protector-triage/SKILL.md · Use when an Android APK is packed by a commercial protector — detect with apkid + protector_detect, structurally unpack…

dreadnode/capabilities · capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md · Use when hunting Android APK logic bugs at scale — deep links, intent redirection, WebView trust, exported components…

dreadnode/capabilities · capabilities/android-apk-research/skills/android-targeted-assessment/SKILL.md · Use when assessing one Android APK deeply — inventory, decompile, ripgrep + Semgrep triage, Joern/CodeQL/FlowDroid…

dreadnode/capabilities · capabilities/atlassian/skills/atlassian/SKILL.md · Use when the user wants to connect to Jira, Confluence, or Compass — search issues with JQL, read or create issues and…

dreadnode/capabilities · capabilities/attack-surface-management/skills/bbot-module-reference/SKILL.md · BBOT module and preset reference for reconnaissance scanning. Use when choosing which modules, presets, or flags to use…

dreadnode/capabilities · capabilities/attack-surface-management/skills/cypher-query-playbook/SKILL.md · Neo4j Cypher query patterns for analyzing BBOT reconnaissance data in the graph database. Use when you need to analyze…

dreadnode/capabilities · capabilities/attack-surface-management/skills/reconnaissance-planning/SKILL.md · Strategic reconnaissance planning for external attack surface management. Use when starting a new engagement, choosing…

dreadnode/capabilities · capabilities/attack-surface-management/skills/screenshot-triage/SKILL.md · Triage web application screenshots to identify high-value targets for manual investigation. Use when analyzing…

dreadnode/capabilities · capabilities/attack-surface-management/skills/shodan-reconnaissance/SKILL.md · Shodan query strategies for internet-wide host intelligence, asset discovery, vulnerability correlation, and attack…

dreadnode/capabilities · capabilities/azure-devops/skills/azure-devops/SKILL.md · Use when the user wants to connect to Azure DevOps — query Boards work items with WIQL, read PRs, inspect pipeline…

dreadnode/capabilities · capabilities/binary-analysis/skills/binary-analysis/SKILL.md · Reverse-engineer native binaries (PE, ELF, Mach-O, shellcode) end-to-end — triage, identify and unpack packers, bypass…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/ad-entity-walk/SKILL.md · Investigate a single AD or Azure principal — who controls it, what it controls, where it has admin rights, and what's…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/attack-path-triage/SKILL.md · Walk a BloodHound Enterprise deployment's active attack-path findings, prioritise them by severity and exposure, and…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/attack-pattern-explore/SKILL.md · Drive a self-directed survey of a BloodHound Enterprise deployment using the curated attack-pattern catalog. Walks the…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/bhe-bootstrap/SKILL.md · Establish a working session against a BloodHound Enterprise deployment — verify credentials, identify the environment…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/cypher-investigation/SKILL.md · Open-ended graph investigation via raw OpenCypher queries. Use when the prebuilt tools don't capture the question —…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/data-ingestion/SKILL.md · Push SharpHound / AzureHound collection data into a BloodHound Enterprise deployment, monitor the ingest pipeline, and…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/exposure-trending/SKILL.md · Compare BHE posture between two points in time — what got better, what got worse, and which specific findings drove the…

dreadnode/capabilities · capabilities/bloodhound-enterprise/skills/tier-zero-audit/SKILL.md · Audit the Tier Zero asset group — list members, validate that every inclusion is intentional, identify drift since the…

dreadnode/capabilities · capabilities/bloodhound/skills/bloodhound/SKILL.md · Use when analyzing Active Directory attack paths, querying the BloodHound graph, or assessing domain security posture.

dreadnode/capabilities · capabilities/dotnet-reversing/skills/dotnet-reversing/SKILL.md · Use when reverse engineering .NET assemblies, decompiling DLLs/EXEs, or hunting for vulnerabilities in .NET…

dreadnode/capabilities · capabilities/dotnet-reversing/skills/mcr-analysis/SKILL.md · Use when analyzing .NET applications from Microsoft Container Registry (MCR) images without running containers.

dreadnode/capabilities · capabilities/ghostwriter-readonly/skills/ghostwriter-readonly/SKILL.md · Use when reviewing GhostWriter data in read-only mode — clients, projects, findings, objectives, targets, scope…

dreadnode/capabilities · capabilities/github/skills/github/SKILL.md · Use when the user wants to connect to GitHub, search or read issues / PRs / code, create or update issues and PRs…

dreadnode/capabilities · capabilities/gitlab/skills/gitlab/SKILL.md · Use when the user wants to connect to GitLab — search or read issues / MRs / projects, create or update issues and MRs…

dreadnode/capabilities · capabilities/ios-forensics/skills/activity-reconstruction/SKILL.md · Reconstruct what happened on an iOS device and when — application usage, backgrounds/foregrounds, device lock state…

dreadnode/capabilities · capabilities/ios-forensics/skills/communications-analysis/SKILL.md · Review SMS / iMessage / calls / contacts / mail / third-party messengers recovered from an iOS acquisition to surface…

dreadnode/capabilities · capabilities/ios-forensics/skills/config-and-persistence-review/SKILL.md · Review iOS configuration surfaces that enable persistence or surveillance — configuration profiles, MDM, TCC grants…

dreadnode/capabilities · capabilities/ios-forensics/skills/ios-image-triage/SKILL.md · Structured first-pass triage of an unknown iOS acquisition — iTunes/Finder backup or full-filesystem extraction. Use…

dreadnode/capabilities · capabilities/ios-forensics/skills/spyware-hunt/SKILL.md · Hunt for mercenary iOS spyware — Pegasus, Predator, QuaDream, RCS, Hermit. Correlates STIX IoCs across SMS, Safari…

dreadnode/capabilities · capabilities/linear/skills/linear/SKILL.md · Use when the user wants to connect to Linear, search or read Linear issues / projects / cycles, create or update…

dreadnode/capabilities · capabilities/llm-wiki/skills/llm-wiki/SKILL.md · Use when building, querying, revising, or linting a persistent LLM-maintained wiki from source material in Dreadnode…

dreadnode/capabilities · capabilities/memory-forensics/skills/credential-theft-hunt/SKILL.md · Recover credentials and detect credential-theft tradecraft from a memory image — SAM hashes, LSA secrets, cached domain…

dreadnode/capabilities · capabilities/memory-forensics/skills/memory-triage/SKILL.md · Structured first-pass triage of an unknown memory image. Use when handed a .mem/.raw/.vmem/.dmp/.lime/.bin/.aff4 and…

dreadnode/capabilities · capabilities/memory-forensics/skills/persistence-hunt/SKILL.md · Enumerate persistence mechanisms visible in memory — Run keys, services, scheduled tasks, WMI event subscriptions, COM…

dreadnode/capabilities · capabilities/memory-forensics/skills/process-injection-hunt/SKILL.md · Hunt for code injection in memory — classic injection, reflective loaders, process hollowing, APC injection, and thread…

dreadnode/capabilities · capabilities/memory-forensics/skills/yara-memory-hunting/SKILL.md · Use YARA against memory images to locate known malware, C2 frameworks, and custom IoCs. Covers rule selection, scoping…

dreadnode/capabilities · capabilities/mythic-c2-readonly/skills/mythic-c2-readonly/SKILL.md · Use when reviewing Mythic C2 operation data in read-only mode — viewing callbacks, task history, credentials, files…

dreadnode/capabilities · capabilities/network-ops/skills/ad-attack-patterns/SKILL.md · Common Active Directory attack chains with tool mappings. Covers Kerberoasting, AS-REP roasting, RBCD, AD CS, DCSync…

dreadnode/capabilities · capabilities/network-ops/skills/ad-enumeration-playbook/SKILL.md · Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and…

dreadnode/capabilities · capabilities/network-ops/skills/network-ops-methodology/SKILL.md · Load when performing network operations or Active Directory exploitation. Enforces enumeration-before-attack…

dreadnode/capabilities · capabilities/secure-software/skills/enrichment-playbook/SKILL.md · Enrich a downloaded package artifact with reversing and vulnerability analysis data — archive extraction, per-file…

dreadnode/capabilities · capabilities/secure-software/skills/package-triage/SKILL.md · Triage a suspicious or newly encountered software package end-to-end using Spectra Assure Community reports, OSV…

dreadnode/capabilities · capabilities/secure-software/skills/supply-chain-analysis/SKILL.md · Analyse the supply chain of a project's dependency closure using Spectra Assure reports, SBOM export…

dreadnode/capabilities · capabilities/sliver-c2/skills/sliver-c2/SKILL.md · Use when operating Sliver C2 implants, managing listeners, or performing post-exploitation via sessions or beacons.

dreadnode/capabilities · capabilities/spectra-assure/skills/spectra-assure/SKILL.md · Use when scanning third-party packages, manifests, or lockfiles for malware, tampering, vulnerabilities, or policy…

dreadnode/capabilities · capabilities/vuln-assessment-methodology/skills/vuln-assessment-methodology/SKILL.md · Load when performing vulnerability assessment in any domain. Enforces source-to-sink tracing, disprove-first analysis…

dreadnode/capabilities · capabilities/web-security/skills/403-bypass/SKILL.md · Systematic 403/401 bypass via header spoofing, path manipulation, verb tampering, and protocol tricks. Use when…

dreadnode/capabilities · capabilities/web-security/skills/aem-sling-exploitation/SKILL.md · Adobe Experience Manager (AEM) and Apache Sling exploitation — Sling selector abuse, dispatcher bypass chains, JCR…

dreadnode/capabilities · capabilities/web-security/skills/agent-browser/SKILL.md · Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages…

dreadnode/capabilities · capabilities/web-security/skills/apache-confusion-attacks/SKILL.md · Exploit Apache httpd semantic parsing ambiguities for ACL bypass, SSRF, source disclosure, and RCE. Use when Apache…

dreadnode/capabilities · capabilities/web-security/skills/app-layer-dos/SKILL.md · Application-layer denial-of-service testing — ReDoS, decompression bombs (gzip request bodies), server processing…

dreadnode/capabilities · capabilities/web-security/skills/archive-path-traversal/SKILL.md · Craft malicious archives (ZIP/TAR) to test extraction vulnerabilities including Zip Slip, symlink attacks, hardlink…

dreadnode/capabilities · capabilities/web-security/skills/auth-matrix-testing/SKILL.md · Systematic authentication, authorization, privilege escalation, and IDOR testing methodology. Enforces multi-attempt…

dreadnode/capabilities · capabilities/web-security/skills/blind-sqli-extraction/SKILL.md · Extract data from boolean and timing-based blind SQL injection points. Use when you have a confirmed injection point…

dreadnode/capabilities · capabilities/web-security/skills/blind-ssrf-chains/SKILL.md · Escalate blind SSRF to proven impact via internal service canaries, port fingerprinting, chained exploitation targeting…

dreadnode/capabilities · capabilities/web-security/skills/browser-side-channel/SKILL.md · Browser-based side channel attacks for cross-origin data leaks via connection pool exhaustion, ETag oracles, timing…

dreadnode/capabilities · capabilities/web-security/skills/burp-suite/SKILL.md · Queries Burp proxy history, sends requests via Repeater, configures Intruder attacks, retrieves scanner findings, and…

dreadnode/capabilities · capabilities/web-security/skills/caido-mode/SKILL.md · Full Caido TypeScript SDK CLI (the official @caido/sdk-client / caido-ts library). Search HTTP history with HTTPQL…

dreadnode/capabilities · capabilities/web-security/skills/caido-proxy/SKILL.md · Caido proxy integration for HTTP history search, request replay, fuzzing results, sitemap, and security findings via…

dreadnode/capabilities · capabilities/web-security/skills/caido-sdk/SKILL.md · Direct Caido interaction via the caido-sdk-client Python library, bypassing the Caido MCP server. Prefer this over the…

dreadnode/capabilities · capabilities/web-security/skills/config-file-parsing-bugs/SKILL.md · Exploit config file parser vulnerabilities: line length truncation, duplicate section overwrites, encoding…

dreadnode/capabilities · capabilities/web-security/skills/content-type-mime-diff/SKILL.md · MIME Content-Type parser differentials between browsers and server-side libraries for XSS. Browsers treat Content-Type…

dreadnode/capabilities · capabilities/web-security/skills/crlf-response-splitting/SKILL.md · Nested response splitting to bypass strict CSP via CRLF injection. Turns header injection into XSS even when script-src…

dreadnode/capabilities · capabilities/web-security/skills/csp-bypass/SKILL.md · Bypass Content-Security-Policy to achieve XSS when CSP blocks inline scripts. Covers JSONP gadgets, framework abuse…

dreadnode/capabilities · capabilities/web-security/skills/cspt-xss/SKILL.md · Client-Side Path Traversal — exploit CSR/SSR apps where URL parameters control fetch/XHR paths to inject cross-origin…

dreadnode/capabilities · capabilities/web-security/skills/custom-sanitizer-audit/SKILL.md · Audit custom sanitization functions for bypass vulnerabilities using the Five-Point Checklist and ordering analysis…

dreadnode/capabilities · capabilities/web-security/skills/data-exfil/SKILL.md · AI/LLM data exfiltration techniques via rendered markdown, HTML-in-markdown, tool artifacts, domain encoding, and…

dreadnode/capabilities · capabilities/web-security/skills/distributed-routing-testing/SKILL.md · Geo-distributed DNS resolution via in-region open resolvers (Shodan/Censys) to detect geo-fenced infrastructure…

dreadnode/capabilities · capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md · DOM-based XSS and client-side vulnerability detection via dynamic analysis -- trace attacker-controlled sources to…

dreadnode/capabilities · capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md · Static code analysis for DOM-based vulnerabilities in client-side JavaScript -- source/sink enumeration via grep and…

dreadnode/capabilities · capabilities/web-security/skills/dompurify-mxss-bypass/SKILL.md · Crafts mutation XSS payloads, identifies namespace confusion vectors, and exploits parsing differentials in DOMPurify…

dreadnode/capabilities · capabilities/web-security/skills/doubleclickjacking/SKILL.md · Clickjacking variant bypassing X-Frame-Options, CSP frame-ancestors, and SameSite cookies via double-click timing…

dreadnode/capabilities · capabilities/web-security/skills/esi-injection/SKILL.md · Inject ESI/SSI tags to achieve XSS, cookie theft, SSRF, or WAF bypass via edge/cache layer processing. Use when target…

dreadnode/capabilities · capabilities/web-security/skills/exploit-verifier/SKILL.md · Sentinel-V exploit verification agent — replays exploit payloads, validates CVE applicability, generates…

dreadnode/capabilities · capabilities/web-security/skills/git-integration-exploitation/SKILL.md · Exploit git integrations in SaaS and cloud services -- argument injection per git subcommand, JGit vs native git attack…

dreadnode/capabilities · capabilities/web-security/skills/graphql-pentest/SKILL.md · GraphQL endpoint discovery, resource abuse (batching, alias amplification, circular fragments, deep nesting)…

dreadnode/capabilities · capabilities/web-security/skills/grpc-web-pentest/SKILL.md · Pentest gRPC-Web services via CORS abuse, JSON transcoder bypass, and payload manipulation. Use when target serves…

dreadnode/capabilities · capabilities/web-security/skills/h2-connect-internal-scan/SKILL.md · Internal port scanning and SSRF via HTTP/2 CONNECT method -- enumerates internal services, detects open ports, and…

dreadnode/capabilities · capabilities/web-security/skills/h2-waf-bypass/SKILL.md · Bypass WAF body/path inspection via HTTP/2 binary framing — delayed DATA frames blind out-of-process WAFs, body size…

dreadnode/capabilities · capabilities/web-security/skills/h2c-websocket-smuggling/SKILL.md · Bypass reverse proxy ACLs via H2C upgrade or WebSocket tunnel. Use when proxy blocks internal paths but forwards…

dreadnode/capabilities · capabilities/web-security/skills/hackerone-recon/SKILL.md · Pre-engagement reconnaissance workflow using HackerOne MCP tools to enumerate program scope, study prior disclosures…

dreadnode/capabilities · capabilities/web-security/skills/http-connection-contamination/SKILL.md · Misroute requests across subdomains via HTTP/2+ connection coalescing on shared infrastructure with wildcard TLS certs…

dreadnode/capabilities · capabilities/web-security/skills/http-desync-smuggling/SKILL.md · HTTP request smuggling via body framing disagreements — CL.TE, TE.CL, CL.0, TE obfuscation, duplicate Content-Length…

dreadnode/capabilities · capabilities/web-security/skills/http-query-method/SKILL.md · Exploit HTTP QUERY method (RFC 10008, June 2026) parser differentials -- WAF body inspection bypass, cache poisoning…

dreadnode/capabilities · capabilities/web-security/skills/initial-recon/SKILL.md · Use when beginning a web assessment from a domain, wildcard, ASN, organization, IP list, or CIDR and measurable…

dreadnode/capabilities · capabilities/web-security/skills/inline-script-breakout-exfil/SKILL.md · Exfiltrate data from stored XSS inside inline script blocks when constrained by unquoted HTML attribute context, WAF…

dreadnode/capabilities · capabilities/web-security/skills/insecure-defaults/SKILL.md · Detect fail-open insecure defaults: hardcoded secrets, weak auth, permissive security that allow apps to run insecurely…

dreadnode/capabilities · capabilities/web-security/skills/ip-rotation/SKILL.md · Use IP rotation proxies (flareprox and fireprox) to bypass rate limiting, IP bans, and geo-blocking during web security…

dreadnode/capabilities · capabilities/web-security/skills/kiterunner/SKILL.md · API-aware content discovery using Swagger/OpenAPI-derived wordlists. Sends properly formatted requests with correct…

dreadnode/capabilities · capabilities/web-security/skills/libmagic-type-confusion/SKILL.md · Bypass file type detection using libmagic's JSON nesting depth limit to force type confusion. Use when file uploads…

dreadnode/capabilities · capabilities/web-security/skills/math-rendering-macro-injection/SKILL.md · Abuse user-controlled TeX/LaTeX macros in MathJax and KaTeX renderers to override built-in operators, spoof rendered…

dreadnode/capabilities · capabilities/web-security/skills/mcp-auth-exploitation/SKILL.md · Exploit MCP authorization flows — CIMD SSRF via client_manifest_uri/logo_uri/jwks_uri, Dynamic Client Registration…

dreadnode/capabilities · capabilities/web-security/skills/nextjs-cache-poisoning/SKILL.md · Internal cache poisoning in Next.js via stale cache entries and header manipulation. Use when target runs Next.js…

dreadnode/capabilities · capabilities/web-security/skills/oauth-flow-hijack/SKILL.md · Techniques to hijack OAuth flows by stopping redirects, leaking authorization codes, and exploiting popup or iframe…

dreadnode/capabilities · capabilities/web-security/skills/orm-filter-data-leak/SKILL.md · Exploit ORM search/filter endpoints to leak data from joined/related tables via relationship traversal operators. Use…

dreadnode/capabilities · capabilities/web-security/skills/pacu-aws-exploitation/SKILL.md · AWS exploitation and post-compromise validation with Pacu. Use when an authorized web test yields AWS credentials…

dreadnode/capabilities · capabilities/web-security/skills/parser-differential-bypass/SKILL.md · Exploit parsing differences between frontend/backend, proxy/origin, or WAF/app to bypass auth, ACLs, and input…

dreadnode/capabilities · capabilities/web-security/skills/phone-verification/SKILL.md · Retrieve SMS verification codes from public or private phone number services. Use when signup, login, recovery, or MFA…

dreadnode/capabilities · capabilities/web-security/skills/php-filter-chain-oracle/SKILL.md · Leak file contents via PHP filter chain error-based oracle using memory exhaustion differentials. Use when PHP target…

dreadnode/capabilities · capabilities/web-security/skills/race-condition-single-packet/SKILL.md · Single-packet race conditions for exploiting multi-step flows via precise HTTP/2 request synchronization. Use when…

dreadnode/capabilities · capabilities/web-security/skills/report-preflight/SKILL.md · Pre-submission eligibility check for bug bounty findings. Catches ineligible patterns, AI/scanner false positives, and…

dreadnode/capabilities · capabilities/web-security/skills/response-queue-poisoning/SKILL.md · Escalate HTTP header injection (CRLF in URL path or parameters) to critical impact via response queue poisoning and…

dreadnode/capabilities · capabilities/web-security/skills/saas-provider-url-ssrf/SKILL.md · Two-phase SSRF via configurable provider URLs in SaaS integrations (SSO OIDC issuers, Git server base URLs, OAuth…

dreadnode/capabilities · capabilities/web-security/skills/salesforce-aura-testing/SKILL.md · Salesforce Aura guest user CRUD enumeration on Experience Cloud communities. Prevents the common miss of testing…

dreadnode/capabilities · capabilities/web-security/skills/scorer-reference/SKILL.md · SDK rubrics and scorers for web-security evaluation tasks. Use when configuring task.yaml verification, composing…

dreadnode/capabilities · capabilities/web-security/skills/self-xss-escalation/SKILL.md · Escalate self-XSS to full-impact XSS via login CSRF, cookie bombing, path-specific cookie precedence, and double-XSS…

dreadnode/capabilities · capabilities/web-security/skills/soapwn-wsdl-rce/SKILL.md · Exploit .NET WSDL proxy (HttpWebClientProtocol) to achieve arbitrary file write and RCE via SOAP service import -- a…

dreadnode/capabilities · capabilities/web-security/skills/sqli-to-rce-escalation/SKILL.md · Escalate a confirmed SQL injection point into server-side command execution or a webshell. Use when you already have…

dreadnode/capabilities · capabilities/web-security/skills/ssrf-ip-filter-bypass/SKILL.md · Bypass IP-based SSRF filters using hex/octal/decimal encoding of blocked addresses. Use when SSRF endpoint has…

dreadnode/capabilities · capabilities/web-security/skills/ssrf-redirect-loop/SKILL.md · Upgrade blind SSRF to visible using HTTP redirect loops and error differential analysis. Use when blind SSRF confirmed…

dreadnode/capabilities · capabilities/web-security/skills/ssti-error-based-detection/SKILL.md · Error-based blind SSTI detection using polyglot payloads and error message differentials to fingerprint template…

dreadnode/capabilities · capabilities/web-security/skills/subdomain-takeover-check/SKILL.md · Ground-truth subdomain takeover candidates by checking CNAME resolution, verifying service availability, and validating…

dreadnode/capabilities · capabilities/web-security/skills/te0-request-smuggling/SKILL.md · TE.0 request smuggling where front-end processes Transfer-Encoding chunked but back-end ignores it entirely. Use when…

dreadnode/capabilities · capabilities/web-security/skills/timing-attack-recon/SKILL.md · Discover hidden parameters, headers, and scoped SSRFs via server-side timing differentials. Use when traditional…

dreadnode/capabilities · capabilities/web-security/skills/type-confusion-testing/SKILL.md · Exploit type confusion vulnerabilities where applications receive unexpected data types (array instead of string, null…

dreadnode/capabilities · capabilities/web-security/skills/unicode-normalization-bypass/SKILL.md · Bypass WAFs and input filters using Unicode normalization equivalents (NFKC/NFKD). Use when WAF blocks payloads but…

dreadnode/capabilities · capabilities/web-security/skills/url-prompt-injection/SKILL.md · Detect ?q= and similar URL parameters that pre-fill or auto-submit prompts in chatbot/agent UIs. Cross-site prompt…

dreadnode/capabilities · capabilities/web-security/skills/vuln-critic/SKILL.md · Adversarial pre-filter for scanner and agent findings. Scores findings as APPROVED/REJECTED/NEEDS_REFINEMENT before…

dreadnode/capabilities · capabilities/web-security/skills/vuln-kb/SKILL.md · Local vulnerability knowledge base with CWE references, attack playbooks by tech stack, and detection signatures. Use…

dreadnode/capabilities · capabilities/web-security/skills/web-cache-deception-path/SKILL.md · Web cache deception via path delimiter confusion between CDN/cache and origin server. Use when CDN (Cloudflare, Akamai…

dreadnode/capabilities · capabilities/web-security/skills/wrangler-oast/SKILL.md · Deploy Cloudflare Workers as custom OAST endpoints for blind XSS payload hosting, configurable callback receivers, and…

dreadnode/capabilities · capabilities/web-security/skills/write-path-to-rce/SKILL.md · Escalate arbitrary file write into code execution -- plant malicious Jinja2/EJS/Razor/Blade templates, overwrite…

dreadnode/capabilities · capabilities/web-security/skills/xslt-injection/SKILL.md · Exploit XSLT processor injection for file read, SSRF, and RCE. Use when target processes XML with user-influenced…

dreadnode/capabilities · scripts/fixtures/clean-skill/SKILL.md · A clean skill used for security scanner testing

dreadnode/capabilities · scripts/fixtures/malicious-skill/SKILL.md · Test malicious skill for security scanner validation