SkillsAdd

transilienceai/communitytools

server-side

Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

First seen Mar 21, 2026

Installation

$ npx skills add transilienceai/communitytools --skill server-side
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs
azure-aigateway Same topic
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Same topic
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs

Also in this package

Other skills from transilienceai/communitytools · top by installs.

npx skills add transilienceai/communitytools
attack-path-stitcher 653 hackerone 236 osint 174 reconnaissance 166 cve-poc-generator 152 social-engineering 149 source-code-scanning 142 api-security 141 web-app-logic 139 techstack-identification 137

Browse all from transilienceai/communitytools

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 516
License LICENSE
Default branch main
Open issues 8
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,942 B
  • docs SUMMARY.md 166 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 135 installs

SKILL.md

Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

Techniques

Type Key Vectors
SSRF Internal service access, cloud metadata, protocol smuggling
HTTP Smuggling CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync
Path Traversal Directory traversal, null bytes, encoding bypass
File Upload Extension bypass, content-type manipulation, polyglot files
Deserialization Java, PHP, Python, .NET gadget chains
Host Header Password reset poisoning, cache poisoning, routing-based SSRF
CUPS / cups-browsed CVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md)

Workflow

  1. Identify server-side processing points
  2. Test for vulnerability class indicators
  3. Bypass protections (WAF, allowlists, encoding filters)
  4. Demonstrate impact (file read, RCE, internal access)
  5. Capture evidence with PoC

Reference

  • reference/scenarios/ssrf/*.md - SSRF techniques and labs
  • reference/http-request-smuggling*.md - Smuggling techniques
  • reference/scenarios/path-traversal/*.md - Path traversal bypass methods
  • reference/file-upload*.md - File upload exploitation
  • reference/insecure-deserialization*.md - Deserialization attacks
  • reference/http-host-header*.md - Host header injection
  • skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug