← all domains
4 skills

API & Infrastructure

Mass assignment, JWT/CORS flaws, GraphQL introspection, prototype pollution, cloud misconfiguration, and NTLM leak patterns.

/hunt-api-misconfigBoth ✓
API Misconfig Hunter
API security misconfiguration — mass assignment, JWT attacks, prototype pollution, CORS wildcard with credentials, and HTTP verb tampering.
/hunt-cloud-misconfigBoth ✓
Cloud Misconfig Hunter
Cloud storage and service misconfiguration — S3 bucket ACL, GCS bucket enumeration, Azure blob public access, and metadata endpoint exposure.
/hunt-graphqlBoth ✓
GraphQL Deep Dive
GraphQL security deep dive — introspection bypass, batching amplification, field-level authorization bypass, and subscription abuse.
/hunt-ntlm-infoLimited ⚠
NTLM Info Hunter
NTLM information disclosure — internal hostname/domain leak via 401 challenges on web-exposed endpoints, NTLM relay preconditions.

Ready to install your first skill? Start in minutes.

Browse all 8 attack domains — 51 specialized skills, MIT licensed.

Browse all 8 domainsRead the install guide

Works with Claude Free, Pro, Teams, and Enterprise · MIT License