web▌

### offensive-idor - - **Skill Name**: idor - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-xss - - **Skill Name**: xss - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-graphql - Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endp - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-request-smuggling - - **Skill Name**: request-smuggling - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-xxe - - **Skill Name**: xxe - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-waf-bypass - - **Skill Name**: waf-bypass - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-rce - - **Skill Name**: rce - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-race-condition - - **Skill Name**: race-condition - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.

Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing. Do NOT use for quick page debugging or network inspection (use chrome-devtools instead).