Individual skill

server-side

Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

skills/server-side/SKILL.md

Read pinned source

Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 613
Repository last updated: Jul 29, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bounty-hunters Repository topic
hackerone Repository topic
pentest Repository topic
pentest-tool Repository topic
security Repository topic
security-research Repository topic
security-tools Repository topic
security Derived category
testing Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 1,942 bytes
reference/INDEX.mddoc · 6,325 bytes
reference/file-upload-resources.mddoc · 5,403 bytes
reference/http-host-header-resources.mddoc · 5,045 bytes
reference/http-request-smuggling-resources.mddoc · 4,908 bytes
reference/insecure-deserialization-resources.mddoc · 7,241 bytes
reference/protocol-coercion.mddoc · 4,571 bytes
reference/scenarios/deserialization/dotnet-deserialization.mddoc · 11,351 bytes
reference/scenarios/deserialization/java-deserialization.mddoc · 7,409 bytes
reference/scenarios/deserialization/nodejs-deserialization.mddoc · 5,819 bytes
reference/scenarios/deserialization/php-deserialization.mddoc · 6,208 bytes
reference/scenarios/deserialization/python-and-ruby.mddoc · 5,859 bytes
reference/scenarios/deserialization/react-server-components-flight.mddoc · 6,781 bytes
reference/scenarios/deserialization/tools/aspnet_viewstate_build.pyruns · 3,450 bytes
reference/scenarios/file-upload/content-type-and-magic-bytes.mddoc · 3,436 bytes
reference/scenarios/file-upload/defense-evasion-and-yara.mddoc · 5,210 bytes
reference/scenarios/file-upload/extension-bypass.mddoc · 3,642 bytes
reference/scenarios/file-upload/ntfs-junction-write-redirect.mddoc · 6,593 bytes
reference/scenarios/file-upload/ntlm-hash-leak-via-media-upload.mddoc · 5,438 bytes
reference/scenarios/file-upload/path-traversal-and-htaccess.mddoc · 7,764 bytes
reference/scenarios/file-upload/polyglot-and-metadata-injection.mddoc · 7,389 bytes
reference/scenarios/file-upload/python-module-shadowing-via-so.mddoc · 7,403 bytes
reference/scenarios/file-upload/race-conditions.mddoc · 5,326 bytes
reference/scenarios/file-upload/web-shell-payloads.mddoc · 6,405 bytes
reference/scenarios/host-header/auth-bypass-localhost.mddoc · 3,338 bytes
reference/scenarios/host-header/cache-poisoning-via-host.mddoc · 3,111 bytes
reference/scenarios/host-header/password-reset-poisoning.mddoc · 2,890 bytes
reference/scenarios/host-header/routing-ssrf-and-flawed-parsing.mddoc · 4,709 bytes
reference/scenarios/http-smuggling/cl-te.mddoc · 5,001 bytes
reference/scenarios/http-smuggling/cl-zero-and-pause-based.mddoc · 2,424 bytes
reference/scenarios/http-smuggling/exploitation-patterns.mddoc · 3,869 bytes
reference/scenarios/http-smuggling/h2-downgrade.mddoc · 3,586 bytes
reference/scenarios/http-smuggling/te-cl.mddoc · 1,901 bytes
reference/scenarios/http-smuggling/te-te-obfuscation.mddoc · 2,392 bytes
reference/scenarios/path-traversal/basic-payloads-and-encoding.mddoc · 4,598 bytes
reference/scenarios/path-traversal/filter-bypass-techniques.mddoc · 9,354 bytes
reference/scenarios/path-traversal/lfi-to-rce.mddoc · 10,504 bytes
reference/scenarios/path-traversal/nbconvert-jupyter-notebook.mddoc · 7,401 bytes
reference/scenarios/path-traversal/platform-specific.mddoc · 7,168 bytes
reference/scenarios/path-traversal/target-files.mddoc · 7,591 bytes
reference/scenarios/ssrf/blind-detection-and-portscan.mddoc · 4,394 bytes
reference/scenarios/ssrf/cloud-metadata.mddoc · 5,604 bytes
reference/scenarios/ssrf/localhost-and-ip-bypass.mddoc · 6,033 bytes
reference/scenarios/ssrf/protocol-exploitation-gopher.mddoc · 6,232 bytes
reference/scenarios/ssrf/proxy-path-traversal.mddoc · 2,933 bytes
reference/scenarios/ssrf/redis-inline-via-header-name.mddoc · 7,172 bytes
reference/scenarios/ssrf/stored-connector-url-ssrf.mddoc · 7,664 bytes
reference/scenarios/ssrf/url-parser-and-allowlist-bypass.mddoc · 3,214 bytes
reference/scenarios/ssrf/utf8-binary-loss-limit.mddoc · 8,243 bytes
reference/server-side-principles.mddoc · 6,739 bytes

Read excerpt


# Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **SSRF** | Internal service access, cloud metadata, protocol smuggling |
| **HTTP Smuggling** | CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync |
| **Path Traversal** | Directory traversal, null bytes, encoding bypass |
| **File Upload** | Extension bypass, content-type manipulation, polyglot files |
| **Deserialization** | Java, PHP, Python, .NET gadget chains |
| **Host Header** | Password reset poisoning, cache poisoning, routing-based SSRF |