Answers from the documentation; checking which model is on duty
Hi - I answer from the OpenSmartRoute documentation: routing, the API, plans and quotas, self-hosting. Ask away, or open a support ticket if you need a person.
Grounded in the docs - follow a source before acting on it.
hacktricks-cookie-bomb - Skill - OpenSmartRoute
Skillv1.0.0
hacktricks-cookie-bomb
Hacktricks playbook: Cookie Bomb. Exploitation techniques, enumeration, and attack patterns.
Imported from Mriskiali/jb (skills/hacktricks_skills/web-exploitation/cookie-bomb/SKILL.md). Install upstream with npx skills add Mriskiali/jb --skill cookie-bomb. Copyright stays with the author.
A cookie bomb fills a user's cookie jar with enough data that subsequent requests to a target origin carry an oversized Cookie header. If an intermediary or application rejects those requests, the affected user can be locked out of the site while other users remain unaffected. Broad cookie scope can extend the impact to related subdomains.[1][2]
HackerOne report 57356 provides a practical example of this user-specific denial of service.[1]
For broader background on cookie-based attacks and browser limits, see The Cookie Monster in Your Browsers.[2]
Copy one of these into your project. Installing also returns the manifest and these snippets.
# after Install: the listing is in your workspace's routing pool - a plan picks it for its slotcurl-s-X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'
Installed into a catalogue, chosen by a router
Install hacktricks-cookie-bomb and it becomes one more candidate the router can pick - when it fits.
A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.
When a provider is down or over quota the request moves on; the trace says it did.
Manifest
An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.
mriskiali-jb-cookie-bomb.ocm.jsonjson
{
"ocm": "1",
"id": "mriskiali-jb-cookie-bomb",
"kind": "skill",
"name": "hacktricks-cookie-bomb",
"description": "Hacktricks playbook: Cookie Bomb. Exploitation techniques, enumeration, and attack patterns.",
"publisher": "Mriskiali",
"version": "1.0.0",
"capabilities": {
"domains": [
"general"
],
"tags": [
"skill-md",
"pentest",
"exploit",
"hacking",
"github"
],
"languages": [
"en"
]
},
"quality_prior": 0.6,
"examples": [
"Hacktricks playbook: Cookie Bomb. Exploitation techniques, enumeration, and attack patterns."
],
"primary": false,
"metadata": {
"source": {
"provider": "github",
"repository": "https://github.com/Mriskiali/jb",
"path": "skills/hacktricks_skills/web-exploitation/cookie-bomb/SKILL.md",
"ref": "b37baadeb17d40274ae7fff01d72bb62fd8bf2df",
"url": "https://github.com/Mriskiali/jb/blob/b37baadeb17d40274ae7fff01d72bb62fd8bf2df/skills/hacktricks_skills/web-exploitation/cookie-bomb/SKILL.md",
"key": "Mriskiali/jb/skills/hacktricks_skills/web-exploitation/cookie-bomb/SKILL.md"
}
},
"instructions": "# Hacktricks: Cookie Bomb\n\n> Source: [Hacktricks Book](https://book.hacktricks.xyz/) — auto-converted by Cybermes.\n\n# Cookie Bomb\n\n\n\nA cookie bomb fills a user's cookie jar with enough data that subsequent requests to a target origin carry an oversized `Cookie` header. If an intermediary or application rejects those requests, the affected user can be locked out of the site while other users remain unaffected. Broad cookie scope can extend the impact to related subdomains.<sup>[[1]](#references)[[2]](#references)</sup>\n\nHackerOne report 57356 provides a practical example of this user-specific d",
"cost": {
"context_tokens": 262
}
}
Fetch it by URL: GET /api/v1/registry/mriskiali-jb-cookie-bomb/manifest?version=1.0.0
Reviews
Star ratings from people who tried it. One review per account; edit yours any time.
No reviews yet. Install it, try it, and be the first to rate it.
