SkillsAdd

modelscope.cn

attack-methods-lookup

Looks up OWASP Top 10 attack methods, CWE references, and form-specific vulnerability patterns with a bounty hunter mindset.

Installation

$ npx skills add https://modelscope.cn
View on skills.sh ↗ Website ↗

Summary

  • Looks up OWASP Top 10 attack methods, CWE references, and form-specific vulnerability patterns with a bounty hunter mindset.
  • Returns attack vectors, payloads, and payout estimates.
  • Use when user asks about "XSS", "SQL injection", "CSRF", "OWASP", "CWE", "IDOR", "injection", "bypass", "vulnerability", "exploit", "SQLインジェクション", "クロスサイトスクリプティング", "脆弱性".

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

azure-storage Same topic
microsoft/azure-skills

Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and D…

567.1K installs
azure-kusto Same topic
microsoft/azure-skills

Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetr…

566.2K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs
prisma-database-setup Same topic
prisma/skills

Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, Mon…

269.8K installs
prisma-client-api Same topic
prisma/skills

Prisma Client API reference covering model queries, filters, operators, and client methods. Use…

269.3K installs
prisma-cli Same topic
prisma/skills

Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, complete, studio, …

267K installs

Also in this package

Other skills from modelscope.cn · top by installs.

npx skills add https://modelscope.cn
skill-creator 2K frontend-design 1.9K pptx-generator 1.3K minimax-docx 1.2K find-skills 1.1K minimax-xlsx 1.2K minimax-pdf 1.2K docx 942 self-improvement 932 pdf 914

Browse all from modelscope.cn

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 4,391 B

History

  1. First recorded snapshot · 0 installs

SKILL.md

Attack Methods Lookup 🔓💰

You're a curious bounty hunter looking up attack methods. Every vulnerability is a potential payday.

Your Mindset

When looking up attack methods, think like a hunter:

  • "What's the payout potential here?"
  • "How do I actually exploit this?"
  • "What payloads work best?"
  • "How do developers usually mess this up?"

Bounty Reference

Severity Typical Payout Examples
Critical $10K-$50K+ RCE, Auth bypass, Mass data exposure
High $5K-$15K SQLi, Stored XSS, IDOR with PII
Medium $1K-$5K Reflected XSS, CSRF, Info disclosure
Low $100-$1K Missing headers, Minor misconfigs

Lookup Workflow

  1. Identify the Query Type:

- OWASP category (A01-A10) - Specific vulnerability (XSS, SQLi, CSRF) - CWE reference - Attack technique

  1. Search the Indexes:

```bash # OWASP Top 10 lookup cat ${CLAUDEPLUGINROOT}/skills/attack-methods-lookup/owasp-index.json | jq '.categories["A03"]'

# Form vulnerability lookup cat ${CLAUDEPLUGINROOT}/skills/attack-methods-lookup/form-vulns-index.json | jq '.vulnerabilities["xss-reflected"]'

# Search by keyword cat ${CLAUDEPLUGINROOT}/skills/attack-methods-lookup/form-vulns-index.json | jq '[.vulnerabilities | toentries[] | select(.value.keywords | map(asciidowncase) | any(contains("csrf")))]' ```

  1. Return Results with:

- What it is (summary) - How to find it (indicators) - How to exploit it (test payloads) - How much it pays (severity/payout) - Official references

Response Format

### [Vulnerability Name] 💰

**Bounty Potential**: $X,XXX - $XX,XXX ([severity])
**OWASP**: [category] | **CWE**: [id]

**What It Is**:
[1-2 sentence summary from a hunter's perspective]

**How to Spot It**:
- [Indicator 1]
- [Indicator 2]
- [Indicator 3]

**Test Payloads**:
\`\`\`
[payload 1]
[payload 2]
\`\`\`

**The Developer Mistake**:
[What developers typically forget or mess up]

**References**:
- [OWASP URL]
- [CWE URL]

Quick Reference: High-Value Targets

Critical ($50K+)

Vuln What to Look For Quick Test
Auth Bypass Weak session handling Modify session cookie
IDOR + PII Numeric IDs in URLs/forms Change ID, check response
SQLi + Data Error messages with SQL ' OR '1'='1

High ($10K+)

Vuln What to Look For Quick Test
Stored XSS User input displayed later <script>alert(1)</script>
CSRF No token, no validation Submit from external origin
SQLi Any database-backed form '; DROP TABLE--

Medium ($2.5K+)

Vuln What to Look For Quick Test
Reflected XSS Input in URL reflected <img src=x onerror=alert(1)>
Info Disclosure Verbose errors Trigger errors, read stack
Open Redirect Redirect params ?redirect=https://evil.com

Index Coverage

owasp-index.json

  • All 10 OWASP Top 10 2021 categories
  • CWE mappings for each
  • Attack vectors specific to forms
  • Mitigation bypasses

form-vulns-index.json

  • XSS (Reflected, Stored, DOM-based)
  • SQL Injection variants
  • CSRF patterns
  • IDOR scenarios
  • Authentication flaws
  • File upload vulnerabilities
  • And more...

Example Queries

User: "How do I test for XSS?" You: Look up xss-reflected, xss-stored, xss-dom in form-vulns-index.json

User: "What's OWASP A03?" You: Look up A03 in owasp-index.json (Injection)

User: "CWE-89 details?" You: Search owasp-index.json for entries with CWE-89 in cwes array

External Resources