novaestellar/novahaku

novaestellar/novahaku · SKILL.md · Novahaku — 统一安全研究代理。Web测试、提示工程、攻击框架、逆向工程、请求重构、OSINT侦察、CTF竞赛、源码猎人、MCP工具集成。所有能力,单一技能,自动检测。与novaxinwei(v1.1)协同…

novaestellar/novahaku · docs/docs-generator/SKILL.md · Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs…

novaestellar/novahaku · identity/novahaku-files/claude-config-bundle/CLAUDE.md

novaestellar/novahaku · testing/api-security/SKILL.md · Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication…

novaestellar/novahaku · testing/apk-reverse/SKILL.md · 在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的…

novaestellar/novahaku · testing/binary-diff/SKILL.md · 跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。 适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。 核心方法：用 LLM…

novaestellar/novahaku · testing/browser-automation/SKILL.md · 统一自动化入口。覆盖浏览器自动化（Playwright）和 Windows 桌面应用自动化（OpenReverse）。 浏览器场景：打开网页、点击、填表、爬取、截图、自动化登录、渗透页面交互。 桌面场景：操作 IDA/x64dbg 等…

novaestellar/novahaku · testing/browser-extension-reverse/SKILL.md · Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background…

novaestellar/novahaku · testing/case-review/SKILL.md · Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage…

novaestellar/novahaku · testing/cloud-k8s/SKILL.md · Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig…

novaestellar/novahaku · testing/cloud-saas-exposure/SKILL.md · Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via…

novaestellar/novahaku · testing/code-audit/SKILL.md · Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API…

novaestellar/novahaku · testing/continuous-exposure-monitoring/SKILL.md · Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop…

novaestellar/novahaku · testing/ctf/competition-ad-certificate-abuse/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AD CS, certificate templates…

novaestellar/novahaku · testing/ctf/competition-agent-cloud/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or…

novaestellar/novahaku · testing/ctf/competition-android-hooking/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing…

novaestellar/novahaku · testing/ctf/competition-browser-persistence/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage…

novaestellar/novahaku · testing/ctf/competition-bundle-sourcemap-recovery/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk…

novaestellar/novahaku · testing/ctf/competition-cloud-metadata-path/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance…

novaestellar/novahaku · testing/ctf/competition-container-runtime/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis…

novaestellar/novahaku · testing/ctf/competition-crypto-mobile/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK…

novaestellar/novahaku · testing/ctf/competition-custom-protocol-replay/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol…

novaestellar/novahaku · testing/ctf/competition-dpapi-credential-chain/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DPAPI masterkeys, vault blobs, browser…

novaestellar/novahaku · testing/ctf/competition-file-parser-chain/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews…

novaestellar/novahaku · testing/ctf/competition-firmware-layout/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for firmware images, partition tables…

novaestellar/novahaku · testing/ctf/competition-forensic-timeline/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact…

novaestellar/novahaku · testing/ctf/competition-graphql-rpc-drift/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for GraphQL schemas, persisted queries…

novaestellar/novahaku · testing/ctf/competition-identity-windows/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP…

novaestellar/novahaku · testing/ctf/competition-ios-runtime/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks…

novaestellar/novahaku · testing/ctf/competition-jwt-claim-confusion/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths…

novaestellar/novahaku · testing/ctf/competition-k8s-control-plane/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis…

novaestellar/novahaku · testing/ctf/competition-kerberos-delegation/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges…

novaestellar/novahaku · testing/ctf/competition-kernel-container-escape/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and…

novaestellar/novahaku · testing/ctf/competition-linux-credential-pivot/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service…

novaestellar/novahaku · testing/ctf/competition-lsass-ticket-material/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon…

novaestellar/novahaku · testing/ctf/competition-mailbox-abuse/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent…

novaestellar/novahaku · testing/ctf/competition-malware-config/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged…

novaestellar/novahaku · testing/ctf/competition-oauth-oidc-chain/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for OAuth, OIDC, redirect flows, state or…

novaestellar/novahaku · testing/ctf/competition-pcap-protocol/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session…

novaestellar/novahaku · testing/ctf/competition-queue-worker-drift/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for queues, async workers, cron jobs…

novaestellar/novahaku · testing/ctf/competition-race-condition-state-drift/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for race windows, ordering bugs…

novaestellar/novahaku · testing/ctf/competition-relay-coercion-chain/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains…

novaestellar/novahaku · testing/ctf/competition-request-normalization-smuggling/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP…

novaestellar/novahaku · testing/ctf/competition-runtime-routing/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers…

novaestellar/novahaku · testing/ctf/competition-ssrf-metadata-pivot/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route…

novaestellar/novahaku · testing/ctf/competition-stego-media/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for image, audio, video, document, and…

novaestellar/novahaku · testing/ctf/competition-supply-chain/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift…

novaestellar/novahaku · testing/ctf/competition-template-render-path/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSR, template rendering, route…

novaestellar/novahaku · testing/ctf/competition-websocket-runtime/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for WebSocket and SSE handshakes, auth…

novaestellar/novahaku · testing/ctf/competition-windows-pivot/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows…

novaestellar/novahaku · testing/ctf/competition-zip-archive/SKILL.md · Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for ZIP and PKZIP archive challenges…

novaestellar/novahaku · testing/database-security/SKILL.md · Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz…

novaestellar/novahaku · testing/digital-forensics/SKILL.md · Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and…

novaestellar/novahaku · testing/dotnet-reverse/SKILL.md · .NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound /…

novaestellar/novahaku · testing/edr-bypass-re/SKILL.md · 逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch /…

novaestellar/novahaku · testing/email-domain-security/SKILL.md · Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone…

novaestellar/novahaku · testing/email-security/SKILL.md · Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC…

novaestellar/novahaku · testing/exposure-risk-quantification/SKILL.md · FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score…

novaestellar/novahaku · testing/firmware-pentest/SKILL.md · 固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk…

novaestellar/novahaku · testing/frameworks/advanced-hunt/SKILL.md · Advanced bug hunting techniques: manual exploitation, recon automation, Burp Suite integration, API/mobile testing for…

novaestellar/novahaku · testing/frameworks/anything-analyzer-mcp/SKILL.md · Use when analyzing web applications via Anything Analyzer MCP. Browser automation, HTTP capture, request replay, and…

novaestellar/novahaku · testing/frameworks/baas/SKILL.md · Use when auditing Supabase/BaaS web apps.

novaestellar/novahaku · testing/frameworks/bughunt/SKILL.md · Automated bug bounty hunting pipeline: scrape programs, scan vulnerabilities, generate PoC, send reports via email

novaestellar/novahaku · testing/frameworks/burpsuite-mcp/SKILL.md · Use when testing web applications via BurpSuite MCP integration. Provides access to 83 BurpSuite tools including Proxy…

novaestellar/novahaku · testing/frameworks/laravel/SKILL.md · Systematic vulnerability assessment of Laravel applications

novaestellar/novahaku · testing/frameworks/nextjs/SKILL.md · Audit Next.js apps: extract + invoke server actions.

novaestellar/novahaku · testing/frameworks/supabase-audit/SKILL.md · Audit Supabase BaaS apps: RLS write paths, RPC nulls.

novaestellar/novahaku · testing/frameworks/turnstile/SKILL.md · Fix captcha failures in auth forms.

novaestellar/novahaku · testing/ghidra-reverse/SKILL.md · Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional…

novaestellar/novahaku · testing/gitlab-exploit/SKILL.md

novaestellar/novahaku · testing/go-rust-reverse/SKILL.md · Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery…

novaestellar/novahaku · testing/hardware-security/SKILL.md · Use for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage…

novaestellar/novahaku · testing/hunt/bb-methodology/SKILL.md · Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next…

novaestellar/novahaku · testing/hunt/bug-bounty/SKILL.md · Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source…

novaestellar/novahaku · testing/hunt/bugcrowd-reporting/SKILL.md · Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no…

novaestellar/novahaku · testing/hunt/evidence-hygiene/SKILL.md · Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to…

novaestellar/novahaku · testing/hunt/hunt-aspnet/SKILL.md · Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser…

novaestellar/novahaku · testing/hunt/hunt-ato/SKILL.md · Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header…

novaestellar/novahaku · testing/hunt/hunt-auth-bypass/SKILL.md · Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW /…

novaestellar/novahaku · testing/hunt/hunt-brute-force/SKILL.md · Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute…

novaestellar/novahaku · testing/hunt/hunt-business-logic/SKILL.md · Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking…

novaestellar/novahaku · testing/hunt/hunt-cache-poison/SKILL.md · Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host…

novaestellar/novahaku · testing/hunt/hunt-captcha-bypass/SKILL.md · Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation…

novaestellar/novahaku · testing/hunt/hunt-cicd/SKILL.md · Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{…

novaestellar/novahaku · testing/hunt/hunt-cloud-misconfig/SKILL.md · Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket…

novaestellar/novahaku · testing/hunt/hunt-cors/SKILL.md · Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored…

novaestellar/novahaku · testing/hunt/hunt-csrf/SKILL.md · Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants —…

novaestellar/novahaku · testing/hunt/hunt-deserialization/SKILL.md · Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET…

novaestellar/novahaku · testing/hunt/hunt-dispatch/SKILL.md · Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the…

novaestellar/novahaku · testing/hunt/hunt-dom/SKILL.md · Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking…

novaestellar/novahaku · testing/hunt/hunt-fintech-graphql/SKILL.md · Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card…

novaestellar/novahaku · testing/hunt/hunt-forgot-password/SKILL.md · Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via…

novaestellar/novahaku · testing/hunt/hunt-graphql/SKILL.md · Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID…

novaestellar/novahaku · testing/hunt/hunt-host-header/SKILL.md · Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host…

novaestellar/novahaku · testing/hunt/hunt-html-injection/SKILL.md · Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an…

novaestellar/novahaku · testing/hunt/hunt-http-smuggling/SKILL.md · Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where…

novaestellar/novahaku · testing/hunt/hunt-idor/SKILL.md · Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

novaestellar/novahaku · testing/hunt/hunt-jwt-crypto/SKILL.md · Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge…

novaestellar/novahaku · testing/hunt/hunt-k8s/SKILL.md · Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler…

novaestellar/novahaku · testing/hunt/hunt-ldap/SKILL.md · Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD…

novaestellar/novahaku · testing/hunt/hunt-lfi/SKILL.md · Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning →…

novaestellar/novahaku · testing/hunt/hunt-llm-ai/SKILL.md · Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling…

novaestellar/novahaku · testing/hunt/hunt-mfa-bypass/SKILL.md · Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change…

novaestellar/novahaku · testing/hunt/hunt-nextjs/SKILL.md · Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static…

novaestellar/novahaku · testing/hunt/hunt-nodejs/SKILL.md · Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy…

novaestellar/novahaku · testing/hunt/hunt-nosqli/SKILL.md · Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth…

novaestellar/novahaku · testing/hunt/hunt-ntlm-info/SKILL.md · Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2…

novaestellar/novahaku · testing/hunt/hunt-oauth/SKILL.md · Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

novaestellar/novahaku · testing/hunt/hunt-open-redirect/SKILL.md · Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter…

novaestellar/novahaku · testing/hunt/hunt-race-condition/SKILL.md · Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2…

novaestellar/novahaku · testing/hunt/hunt-rce/SKILL.md · Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.

novaestellar/novahaku · testing/hunt/hunt-saml/SKILL.md · Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by…

novaestellar/novahaku · testing/hunt/hunt-session/SKILL.md · Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on…

novaestellar/novahaku · testing/hunt/hunt-shadow-api/SKILL.md · Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API…

novaestellar/novahaku · testing/hunt/hunt-source-leak/SKILL.md · Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source…

novaestellar/novahaku · testing/hunt/hunt-spa-api/SKILL.md · Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control…

novaestellar/novahaku · testing/hunt/hunt-springboot/SKILL.md · Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring…

novaestellar/novahaku · testing/hunt/hunt-sqli/SKILL.md · Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection…

novaestellar/novahaku · testing/hunt/hunt-ssrf/SKILL.md · Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne…

novaestellar/novahaku · testing/hunt/hunt-ssti/SKILL.md · Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB…

novaestellar/novahaku · testing/hunt/hunt-websocket/SKILL.md · Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS…

novaestellar/novahaku · testing/hunt/hunt-xss/SKILL.md · Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target…

novaestellar/novahaku · testing/hunt/hunt-xxe/SKILL.md · Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc…

novaestellar/novahaku · testing/hunt/recon-scope-triage/SKILL.md · Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision…

novaestellar/novahaku · testing/hunt/redteam-mindset/SKILL.md · Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from…

novaestellar/novahaku · testing/hunt/report-writing/SKILL.md · Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first…

novaestellar/novahaku · testing/identity-federation/SKILL.md · Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration…

novaestellar/novahaku · testing/identity-provider-recon/SKILL.md · Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle…

novaestellar/novahaku · testing/js-reverse/SKILL.md · 在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_*…

novaestellar/novahaku · testing/keycloak-exploit/SKILL.md

novaestellar/novahaku · testing/llm-security/SKILL.md · Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG…

novaestellar/novahaku · testing/malware-analysis/SKILL.md · Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA…

novaestellar/novahaku · testing/mobile-reverse/SKILL.md · Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis…

novaestellar/novahaku · testing/offensive-osint/SKILL.md · Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13…

novaestellar/novahaku · testing/org-attack-surface/SKILL.md · Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint —…

novaestellar/novahaku · testing/osint-methodology/SKILL.md · Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the…

novaestellar/novahaku · testing/ot-ics/SKILL.md · Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol…

novaestellar/novahaku · testing/pentest-tools/SKILL.md · 主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI…

novaestellar/novahaku · testing/pentest-tools/src-hunter/SKILL.md · 实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类…

novaestellar/novahaku · testing/protocol-reverse/SKILL.md · Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven…

novaestellar/novahaku · testing/pwn-chain/SKILL.md · 从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出…

novaestellar/novahaku · testing/radare2/SKILL.md · Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse…

novaestellar/novahaku · testing/radio-sdr/SKILL.md · Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs…

novaestellar/novahaku · testing/reverse-engineering/SKILL.md · Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or…

novaestellar/novahaku · testing/reverse-engineering/dsl-vm-reverse/SKILL.md · Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use…

novaestellar/novahaku · testing/supply-chain-security/SKILL.md · Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build…

novaestellar/novahaku · testing/thick-client/SKILL.md · Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic…

novaestellar/novahaku · testing/threat-hunting/SKILL.md · Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection…

novaestellar/novahaku · testing/threat-intelligence/SKILL.md · Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat…

novaestellar/novahaku · testing/web2-recon/SKILL.md · Recon pipeline orchestrator — subfinder→httpx→gau→nmap. Findings engine, XLSX report generation. Integrates with…

novaestellar/novahaku · testing/wifi-wireless/SKILL.md · Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection…

novaestellar/novahaku · testing/windows-ad/SKILL.md · Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM…