Results for “authorize”

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections

Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.

• Run authorized Microsoft 365 phishing exercises
• Validate Conditional Access and MFA controls
• Test restrictions on app consent

Use ROADrecon and roadtx during authorized Microsoft Entra ID testing to inspect directory objects and authentication tokens, which represent access permissions. Explore collected configuration offline, test token exchanges, and assess conditional access and device controls.

• Mapping tenant users, groups, roles, and applications
• Reviewing conditional access policies
• Testing token exchanges and device-based single sign-on

Use Scapy, a Python library for working with network packets, to inspect saved captures or authorized live traffic. Summarize protocols and connections, identify suspicious patterns, craft test packets, and export findings as structured JSON reports.

• Investigating saved network captures
• Summarizing traffic volumes, protocols, and connection endpoints
• Checking for SYN floods and DNS data leakage indicators

Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.

• Check stored iOS app data for sensitive information
• Inspect HTTPS traffic during authorized testing
• Observe authentication behavior without source code

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Plan authorized security exercises that simulate attackers reaching important assets. Organize techniques into attack stages, rank effort and detection risk, identify shared points across attack paths, and use findings to assess detection and response coverage.

• Plan a security exercise with written authorization
• Compare attack paths to critical assets
• Find shared attack steps to prioritize monitoring

Review Apache ShardingSphere pull requests or authorized downstream changes using repository evidence. Assess code correctness, merge readiness, or CI failures, then produce consolidated findings or a ready-to-copy reply to a review discussion.

• Review code changes for correctness and regression risks
• Assess whether a pull request is ready to merge
• Investigate CI failures

Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.

• Planning authorized evidence manipulation tests
• Reviewing Windows and Linux forensic artifacts
• Checking detection coverage for altered evidence

Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.

• Planning an authorized phishing exercise
• Preparing sending infrastructure and landing pages
• Reviewing email, QR code, and callback scenarios

Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.

• Comparing data transfer channels for an authorized exercise
• Planning compression, encryption, and file splitting
• Verifying received files against SHA-256 records

Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.

• Planning authorized phone and SMS security tests
• Reviewing visitor and badge verification procedures
• Designing USB device security exercises

Guide authorized red-team exercises that simulate attackers seeking access and demonstrating impact. The skill organizes test priorities, evidence preservation, related application checks, and minimal data collection, with checklists for planning, ongoing work, and final validation.

• Preparing an authorized red-team exercise
• Reassessing findings after reproduction fails
• Checking related apps for a shared weakness

Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.

• Mapping an organization's externally exposed assets
• Recording evidence sources and confidence levels
• Prioritizing exposures within a limited research budget

Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.

• Discovering public subdomains, APIs, and cloud storage
• Investigating exposed API keys and other secrets
• Identifying SSO services and Microsoft 365 exposure

Monitor another AI agent’s work and independently investigate the same task. Compare the original request with actual changes and test evidence, report gaps and concrete follow-up steps, and make limited fixes when authorized.

• Monitor an agent session until completion or a blocker
• Audit a pull request against the original request
• Compare findings from multiple agents

Monitor one explicitly authorized pull or merge request, inspect current reviews and checks, and fix actionable findings within scope. Apply separate permission and verification conditions before publishing fixes, replying, approving, or merging.

• Following one authorized pull request through review
• Fixing actionable review findings within an agreed scope
• Rechecking reviews and checks after a branch update

Guide authorized testing of security defenses, including web application firewalls, antivirus, and endpoint detection tools. The skill defines scope, alternative testing directions, evidence requirements, and completion criteria for reporting successful bypasses or unsuccessful attempts.

• Define scope for authorized security defense testing
• Choose another direction when testing stalls
• Organize evidence for a successful bypass

Guide authorized subdomain takeover assessments involving DNS records that point to unclaimed resources. The skill defines boundaries, suggests further checks, and specifies evidence for takeover feasibility, potential impact, or a report of unsuccessful investigation.

• Define the scope of an authorized subdomain takeover assessment
• Investigate DNS records pointing to deleted services
• Organize evidence of takeover feasibility and potential impact

Guide authorized testing of open redirects, where a site sends visitors to an unintended destination. This skill defines test boundaries, alternative investigation paths, and the evidence needed to report findings or conclude an investigation.

• Define the scope of an authorized redirect test
• Review evidence for OAuth redirect_uri findings
• Choose another direction when redirect checks stall

Structure authorized cloud security tests covering access permissions, exposed storage, metadata services, and serverless environments. This skill helps agents stay within scope, consider alternative investigation paths, and collect evidence for findings and completion decisions.

• Define the scope of an authorized cloud security test
• Organize evidence for permission and storage findings
• Consider other paths when cloud checks stall

Guide authorized web cache poisoning assessments, where a cache stores an attacker-influenced response. The skill defines test boundaries, suggests alternative investigation paths, and specifies evidence needed to report a finding or document unsuccessful attempts.

• Define the scope of an authorized cache poisoning assessment
• Reconsider investigation paths when cache tests stall
• Organize evidence of poisoned responses reaching other requests

Guide authorized cross-site scripting testing, where injected scripts run in a web page. Define test boundaries, choose alternative investigation paths, and document reproduction evidence before reporting findings or ending an inconclusive investigation.

• Define the scope of an authorized XSS assessment
• Choose another investigation path when checks stall
• Organize reproduction steps and script execution evidence