The yaklang.io Project publishes skills that help AI agents carry out offensive security testing, covering web application work such as WAF bypass, dangling markup injection, HTTP parameter pollution and prototype pollution, along with binary exploitation like stack overflows and ROP chains. Its catalog also reaches into macOS process injection, CSV and spreadsheet formula injection in Excel and GridCraft, and structured reconnaissance for new targets.
Hack Skills
103 skills · 2,627 stars · MIT
401 403 Bypass Techniques 401/403 bypass playbook.
Active Directory Acl Abuse Active Directory ACL abuse playbook.
Active Directory Certificate Services AD Certificate Services attack playbook.
Active Directory Kerberos Attacks Kerberos attack playbook for Active Directory.
Ai Ml Security AI/ML security playbook.
Android Pentesting Tricks Android pentesting playbook.
Anti Debugging Techniques Anti-debugging detection and bypass playbook.
Api Auth And Jwt Abuse API authentication and JWT abuse playbook.
Api Authorization And Bola API authorization and BOLA testing playbook.
Api Recon And Docs API reconnaissance and documentation review playbook.
Api Sec Entry P1 category router for API security.
Arbitrary Write To Rce Arbitrary write to RCE playbook.
Attack Surface Mapping Draw a testable attack surface from one authorized target URL or one application.
Auth Sec Entry P1 category router for authentication and authorization.
Authbypass Authentication Flaws Authentication bypass testing playbook.
Binary Protection Bypass Binary protection bypass playbook.
Browser Exploitation V8 Browser and V8 exploitation playbook.
Business Logic Vuln Entry P1 category router for business logic testing.
Business Logic Vulnerabilities Business logic vulnerability playbook.
Classical Cipher Analysis Classical cipher analysis playbook.
Clickjacking Clickjacking playbook.
Cmdi Command Injection Command injection playbook.
Code Obfuscation Deobfuscation Code obfuscation analysis and deobfuscation playbook.
Container Escape Techniques Container escape playbook.
Cors Cross Origin Misconfiguration CORS misconfiguration testing playbook.
Crlf Injection CRLF injection playbook.
Csp Bypass Advanced Advanced Content Security Policy bypass techniques.
Csrf Cross Site Request Forgery CSRF testing playbook.
Dangling Markup Injection Dangling markup injection playbook.
Defi Attack Patterns DeFi attack pattern playbook.
Dependency Confusion Supply-chain testing via package-manager dependency confusion: when internal package names resolv…
Deserialization Insecure Insecure deserialization playbook.
Dns Rebinding Attacks DNS rebinding attack playbook.
Email Header Injection Email header injection and spoofing playbook.
Expression Language Injection Expression Language injection playbook.
File Access Vuln Entry P1 category router for file access and upload workflows.
Format String Exploitation Format string exploitation playbook.
Ghost Bits Cast Attack Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026).
Graphql And Hidden Parameters GraphQL and hidden parameter testing playbook.
Hack Entry P0 primary router and operating doctrine for HackSkills.
Hash Attack Techniques Hash attack playbook.
Heap Exploitation Heap exploitation playbook.
Http Host Header Attacks HTTP Host header injection and routing abuse playbook.
Http Parameter Pollution HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies,…
Http2 Specific Attacks HTTP/2 protocol-specific attack playbook.
Idor Broken Object Authorization IDOR and broken object authorization testing playbook.
Injection Checking Entry P1 category router for injection testing.
Insecure Source Code Management Source control and artifact exposure (.git, .svn, .hg, backups, .env).