xalgord/xalgorix

AFL++ Fuzzing performs coverage-guided fuzzing of compiled binaries to find crashes and hangs. Use it when instrumenting a target, preparing seed corpora, and triaging unique findings during security testing.

Implement input and output validation guardrails to prevent prompt injection, jailbreaks, PII leaks, and off-topic responses in LLM-powered applications.

Uses LLMs to generate valid fuzzing seeds, evolve grammars from coverage feedback, and help reproduce and triage crashes in authorized security research. Also supports evidence-based analysis of Burp traffic and report drafting.

Implements API abuse detection using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and scraping attacks. Includes distributed Redis-backed limiters with verification steps.

API Authentication Testing checks REST API auth for bypasses, weak JWT validation, exposed endpoints, and token lifecycle issues. Use it when validating login, session, refresh, or API key protections before release.

Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences.

Provides configurations for API gateways (Kong, AWS) to enforce JWT authentication, rate limiting, request validation, and security headers, helping protect backend APIs from injection, token misuse, and other threats.

Systematically discovers all API endpoints in an organization's environment using passive traffic analysis and active probing. Use before security assessments to identify shadow, deprecated, and undocumented APIs.

Implements secure API key generation, hashing, rotation, scoping, and revocation with best practices for server-to-server authentication. Use for protecting API access and preventing key leakage.

Implements API rate limiting and throttling with token bucket, sliding window, and fixed window algorithms. Useful for protecting authentication endpoints, preventing API abuse, and enforcing fair usage quotas.

Implement API schema validation using OpenAPI and JSON Schema to enforce input/output contracts, preventing injection attacks, mass assignment, and data leakage. Ideal for API gateway configuration, compliance, and security assessments.

Continuously discover, classify, and risk-score APIs to maintain visibility over the full API attack surface, including shadow endpoints. Use when deploying API-SPM capabilities or assessing API risk posture.

Performs static security audits on OpenAPI specs and dynamic conformance scanning against live APIs to detect OWASP API Security Top 10 vulnerabilities. Suitable for integrating security testing into CI/CD pipelines and IDE workflows.

Guides the creation of repeatable API security test collections in Postman for OWASP Top 10 coverage, with multi-role authentication testing and CI/CD integration via Newman.

Implements threat protection for APIs using Google Apigee policies such as JSON/XML validation, OAuth 2.0, rate limiting, and injection pattern detection to mitigate OWASP API Security Top 10 threats.

Arbitrary Write to Execution outlines how to turn a write-what-where primitive into control flow in authorized binary exploitation. It covers target selection, mitigations, and trigger paths such as GOT, hooks, exit handlers, and function pointers.

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions. Use when auditing API access controls to ensure only authorized roles can perform privileged actions.

BOLA API Tester checks REST and GraphQL endpoints for broken object level authorization issues. Use it when validating that authenticated users cannot access other users' objects across paths, query parameters, bodies, or GraphQL IDs.

Detects excessive data exposure and mass assignment vulnerabilities in APIs, following the OWASP API3:2023 testing methodology. Use when auditing API security or building detection rules.

Bypassing Binary Exploitation Mitigations outlines how to identify and defeat protections like ASLR, PIE, canaries, NX, and RELRO during authorized exploitation. Use it when a memory-corruption bug is blocked by common binary hardening measures.

Cloud Storage Access Analysis detects abnormal access patterns in AWS S3, GCS, and Azure Blob Storage from audit and data event logs. Use it to hunt for bulk downloads, new source IPs, after-hours access, and other signs of exfiltration or recon.

Provides detection rules and techniques for identifying API enumeration attacks, including BOLA and IDOR, using SIEM queries and scripts.

DevSecOps Security Scanning sets up automated SAST, DAST, SCA, and secrets scanning in CI/CD pipelines. Use it to block deployments with critical vulnerabilities and verify security gates actually fail builds.

Ethereum Smart Contract Vulnerability Analysis performs static and symbolic analysis of Solidity contracts with Slither and Mythril. Use it to find reentrancy, access-control, and arithmetic issues before deployment or during incident investigation.

Tests APIs for excessive data exposure by identifying when endpoints return sensitive data (PII, secrets, internal fields) beyond what the client actually uses. Useful in penetration testing and API security assessments to find data leaks.

Craft malicious model files to test for remote code execution vulnerabilities in AI model-loading pipelines. Covers pickle, Hydra, Keras, archive traversal, and other deserialization attack vectors.

Tests APIs for injection vulnerabilities including SQL, NoSQL, OS command, and LDAP injection. Ideal for automated security testing and penetration testing of API endpoints.

Format String Exploitation outlines how to confirm, leak from, and write through format string bugs in authorized assessments. It covers finding the argument offset, leaking pointers or canaries, and using %n or %hn when available.

Glibc Heap Exploitation outlines methods for exploiting ptmalloc2 bugs such as use-after-free, double-free, overflow, and off-by-one in authorized testing. It covers leaks, tcache poisoning, safe-linking, and modern mitigation-aware workflows.

Configure Google Cloud Identity-Aware Proxy to enforce per-request identity verification for cloud applications, enabling context-aware access without VPN.

GraphQL Depth Limit Attack tests GraphQL endpoints with deeply nested, aliased, and repeated queries to probe for depth and complexity limits. Use it during authorized security assessments to check for denial-of-service exposure.

GraphQL Introspection Testing extracts a GraphQL API schema and checks for exposed types, queries, mutations, subscriptions, and field-level authorization issues. Use it when testing authorized endpoints for introspection, reconstruction, or query-abuse weaknesses.

Integer Overflow Exploitation helps find and confirm wraparound, truncation, underflow, and signedness bugs in native code. It is used during authorized assessments to trace tainted integers into unsafe allocations, copies, or indices.

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the token's specified algorithm, allowing attackers to forge tokens and bypass authentication. Useful for authorized security testing of JWT-based APIs.

JWT None Algorithm Attack tests JWT implementations for acceptance of `alg: none` tokens that bypass signature verification. Use it during authorized security assessments to verify whether forged claims are rejected or accepted.

Tests LLM-backed apps, chatbots, and agents for direct and indirect prompt injection, jailbreaks, prompt leakage, and tool abuse. Use it during authorized security assessments of systems that mix trusted prompts with untrusted inputs or actions.

Linux Kernel Exploitation explains how to turn Linux kernel memory-corruption bugs into stable read and write primitives for authorized research. Use it when triaging crashes, confirming reachability, or assessing privilege-escalation and sandbox-escape impact.

Mass Assignment Testing checks API endpoints for mass assignment flaws where extra client-supplied fields can change privileged object properties. Use it to verify whether create, update, and nested payloads let users set roles, status, balance, or similar fields.

OAuth 2.0 Flaw Testing checks authorization code, redirect URI, PKCE, state, and token handling for security weaknesses. Use it when assessing OAuth or OpenID Connect implementations under written authorization.

Office 365 Audit Log Analysis queries Microsoft Graph Unified Audit Logs to find mailbox forwarding, delegation changes, OAuth consent grants, and other compromise indicators. Use it during incident response or threat hunting for business email compromise.

A multi-layered detector combining regex, heuristic scoring, and a DeBERTa classifier to identify prompt injection attacks in LLM-powered applications. Use it to scan user inputs, audit logs, or integrate as a pre-processing filter.

Tests API rate limiting for bypass vulnerabilities using header manipulation, IP rotation, endpoint variation, and race conditions. Use when assessing brute force protection, credential stuffing, or denial-of-service controls.

Return-Oriented Programming explains how to build ROP chains to reuse existing code when NX/DEP blocks injected shellcode. It covers ret2libc, ret2syscall, alignment, and gadget selection in authorized exploit development.

Runtime Application Self-Protection deploys RASP agents to detect and block attacks from inside an application at runtime. Use it to configure policies, tune coverage, and verify alerts for SQL injection, command injection, SSRF, and similar threats.

SOAP Security Testing analyzes WSDLs and tests SOAP endpoints for XML injection, XXE, SOAPAction spoofing, and WS-Security misconfigurations. Use it during authorized assessments or audits of SOAP web services.

Discovers and inventories shadow API endpoints that operate outside documented specifications using traffic analysis. Used when investigating security incidents, building detection rules, or validating coverage for hidden APIs.

Stack Buffer Overflow Exploitation describes how to confirm, offset, and weaponize stack-based overflows in native binaries during authorized testing. Use it to determine return-address control and build ret2win or ROP payloads.

Supply Chain Attack Simulation checks packages for typosquatting, dependency confusion, hash mismatches, and known vulnerabilities. Use it when assessing or auditing software supply chain security.

Testing Model Context Protocol (MCP) servers and the clients that consume them for tool poisoning, prompt injection, and credential exposure. Use during security assessments of AI agents and IDEs.

WebSocket API Security Testing checks WebSocket endpoints for authentication, authorization, injection, and denial-of-service issues. Use it when assessing real-time APIs for CSWSH, token handling, and message-level access control.

Windows Binary Exploitation covers exploiting 32-bit Windows stack buffer overflows in authorized assessments. Use it to confirm EIP control, find offsets, handle bad characters, and deliver shellcode after a crash.