Ideas Blog Jobs MCP Servers Claude Code

Blog Jobs MCP Claude Code Ideas

About vibehackers

vibehackers is where builders ship before they profit.

We're a community of indie hackers, weekend warriors, career pivoters, and AI-first developers who build in public while learning. No revenue required. No corporate polish needed. Just real projects, rapid prototyping, and the journey from zero to first dollar.

Ship fast. Build publicly. Stay accountable.

Connect

Platform

AI Slop Directory
Build in Public
Submit Project
Updates
About

Vibe Coding Jobs

All Jobs
Categories
Product & UX / Design / Prototyping
Software Engineering
AI/ML & Data
Product/Program/Architecture/Operations
GTM / Marketing / Sales / Customer / DevRel / Training
Locations
Remote
United States
United Kingdom
Germany
India
Canada
Australia

Resources

Validate Idea beta
Ideas Gallery
MCP Servers
Claude Code Directory
Blog
Contact
Vibe Board
Misfeature beta

Legal

Terms of Service
Privacy Policy

© 2026 vibehackersNot cybersecurity. A community for shipping software fast.

Made by@vibehackers

Security — Claude Code Skills, Agents & Commands | Vibehackers

Claude Code/Security

Security for Claude Code

525 curated security skills, agents, commands and plugins — from original author repos, ranked by GitHub signal.

All Plugins Skills Agents Commands

saml-sso-attack

uphiago

Attack SAML SSO via XSW, signature strip, metadata extract.

scada-hikvision-isapi

uphiago

Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.

sector-recon-methodology

PreviousPage 13 of 13

More categories

Code Review & Quality Testing & Debugging Documentation & Writing DevOps & Deployment Git & Workflow Frontend & Design Data & Analytics Productivity & Automation AI & LLM Integration Languages & Frameworks Planning & Project Management Content & Marketing Health & Medical

uphiago

754

Pick sectors, compile targets, batch recon for campaigns.

skill

source-leak-hunt

uphiago

Mass scan for exposed env files, backups, and git configs.

staging-subdomain-hunt

uphiago

Hunt staging via crt.sh when production is WAF-hardened.

stealth-browser-launch

uphiago

Launch stealth Chromium with C++ fingerprint patches for anti-bot bypass.

subdomain-enumeration

uphiago

Map subdomains via crt.sh and subfinder at recon kickoff.

subdomain-takeover-hunt

uphiago

Detect and verify subdomain takeover via dangling CNAME to unclaimed services.

tls-fingerprint-impersonation

uphiago

Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.

unauth-api-flow-hijack

uphiago

Exploit unauthenticated multi-step API flows without credentials.

vhost-enumeration

uphiago

Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.

visual-recon

uphiago

Screenshot all live hosts for rapid visual triage and technology fingerprinting.

web-enumeration

uphiago

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

wordpress-cors-xmlrpc-rce-chain

uphiago

Proven attack chain combining CORS credential reflection on WordPress REST API with XMLRPC methods (system.multicall, wp.uploadFile) and open registration for full RCE. Built from field experience across 58-company mass recon where 5/7 deep targets had CORS credential reflection on WP REST API — including ecommerce-wine.com where the full chain was demonstrated end-to-end.

wordpress-plugin-hunt

uphiago

Hunt WP plugins via REST, exploit CVEs when version known.

wp-mass-recon

uphiago

Batch WP recon: users, CORS, XMLRPC, leaks across domains.

wp-plugin-automation

uphiago

Scripts and workflows to batch-test popular WordPress plugin CVEs across hundreds of domains. Covers automated plugin detection, version extraction from readme.txt, CVE matching against a curated matrix of high-impact plugin vulnerabilities (ElementsKit, Revslider, WPDM, Gravity Forms, Contact Form 7, Jetpack, WP File Manager, GSpeech), and exploitation PoC generation. Use after initial WordPress detection recon — when you have a target list of WP domains and need to find which specific plugin C

wp-plugin-cve-hunt

uphiago

Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version extraction from multiple sources (readme.txt, assets, inline JS), CVE database cross-referencing with WPScan/Patchstack/NVD/NVD API, version-based vulnerability matching, exploitation PoC generation, and false-positive elimination. Built from field experience finding exploitable plugin CVEs across 58-company mass recon including ElementsKit (CVE-2023-6851/CVE-2023-6853), Revslider (

wp-plugin-rest-auth-bypass

uphiago

Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage.

xmlrpc-exploitation

uphiago

Exploit XMLRPC multicall, pingback for brute force and SSRF.

zimbra-attack

uphiago

Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.

Science & Research

Finance & Money

Life & Personal

Office & Documents

Education & Learning

Business & Strategy

Creative Writing

Lifestyle & Hobbies