server-side

Name: server-side
Author: transilienceai

github.com/transilienceaiSecurity598201 installsUpdated 13w ago

About server-side

A server-side security testing skill for finding vulnerabilities that can enable unauthorized access, remote code execution, or data exfiltration. It covers common vulnerability classes and provides a workflow for testing protections and documenting proof of concept evidence.

Key features

01SSRF and HTTP request smuggling tests
02Path traversal and file-upload testing
03Deserialization vulnerability testing
04Host-header vulnerability testing
05CUPS and cups-browsed RCE reference
06Impact validation and evidence capture

Use cases

01Test access to internal services through SSRF
02Assess proxy chains for request smuggling
03Check file handling and deserialization risks
04Verify server-side impact and document a PoC

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/transilienceai/communitytools --skill server-side

After installing, type/server-sidein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

reference/

file-upload-resources.md

http-host-header-resources.md

http-request-smuggling-resources.md

INDEX.md

insecure-deserialization-resources.md

protocol-coercion.md

reference/scenarios/deserialization/

dotnet-deserialization.md

java-deserialization.md

nodejs-deserialization.md

php-deserialization.md

python-and-ruby.md

react-server-components-flight.md

reference/scenarios/deserialization/tools/

aspnet_viewstate_build.py

reference/scenarios/file-upload/

content-type-and-magic-bytes.md

defense-evasion-and-yara.md

extension-bypass.md

ntfs-junction-write-redirect.md

ntlm-hash-leak-via-media-upload.md

path-traversal-and-htaccess.md

polyglot-and-metadata-injection.md

python-module-shadowing-via-so.md

race-conditions.md

web-shell-payloads.md

reference/scenarios/host-header/

auth-bypass-localhost.md

cache-poisoning-via-host.md

password-reset-poisoning.md

routing-ssrf-and-flawed-parsing.md

reference/scenarios/http-smuggling/

cl-te.md

cl-zero-and-pause-based.md

exploitation-patterns.md

Details

From the project README

Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

Techniques

Type	Key Vectors
SSRF	Internal service access, cloud metadata, protocol smuggling
HTTP Smuggling	CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync
Path Traversal	Directory traversal, null bytes, encoding bypass
File Upload	Extension bypass, content-type manipulation, polyglot files
Deserialization	Java, PHP, Python, .NET gadget chains
Host Header	Password reset poisoning, cache poisoning, routing-based SSRF
CUPS / cups-browsed	CVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md`)

Workflow

Identify server-side processing points
Test for vulnerability class indicators
Bypass protections (WAF, allowlists, encoding filters)
Demonstrate impact (file read, RCE, internal access)
Capture evidence with PoC

Reference

reference/scenarios/ssrf/*.md - SSRF techniques and labs
reference/http-request-smuggling*.md - Smuggling techniques
reference/scenarios/path-traversal/*.md - Path traversal bypass methods
reference/file-upload*.md - File upload exploitation
reference/insecure-deserialization*.md - Deserialization attacks
reference/http-host-header*.md - Host header injection
skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug

Comments

Markdown supported

Details

Author: transilienceai
Repository: transilienceai/communitytools
Category: Security
Installs: 201
GitHub stars: 598

Report

More skills

All skills

hyperframes

github.com/heygen-com

1.3M

Read this first for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, slideshow / interactive deck, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.

hyperframes-registry

github.com/heygen-com

1.1M

Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet merging, registry discovery, and authoring a new block or component to contribute upstream (idea → scaffold → validate → PR)

lark-shared

open.feishu.cn

822.9k

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

general-video

github.com/heygen-com

661.3k

The fallback workflow for authoring or editing any custom HyperFrames composition at any length or format — longer / multi-scene pieces, brand and sizzle reels, montages, title cards, static loops, freeform builds. Use only when no specialized workflow fits the input; routing table at /hyperframes.