테스트·보안 스킬

Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious executables, scripts, and macros
• Extracting malicious domains, file paths, and other indicators
• Creating YARA and Sigma detection rules

Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating and auditing a software component inventory
• Prioritizing dependency vulnerabilities by actual exposure
• Auditing CI/CD pipelines and secret handling

Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding unfamiliar compiled programs
• Investigating obfuscation and anti-debugging logic
• Solving CTF validation challenges

Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping Active Directory privilege escalation paths
• Reviewing Kerberos authentication weaknesses
• Testing AD CS certificate configuration weaknesses

Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect certificate templates and enrollment rights
• Trace certificate issuance to accepted authentication
• Identify configuration weaknesses behind granted privileges

Understand compiled Go and Rust programs even when function names have been removed. Use runtime clues, recovered metadata, and error strings to identify important functions and trace application logic with language-specific reverse engineering methods.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing Go binaries with function names removed
• Investigating Rust releases through panic strings
• Recovering Go function names from metadata

Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting an unfamiliar executable file
• Finding the function that uses an error message
• Comparing two versions of a binary

Test desktop application security across local storage, communication between processes, network traffic, and update channels. Map where trust and permissions change, then investigate weaknesses in credentials, access checks, and update verification.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking how desktop apps store credentials
• Reviewing authentication between local processes
• Inspecting app traffic and API access controls

Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing EDR detection coverage in authorized exercises
• Examining internal monitoring mechanisms
• Testing an in-house implant against security products

Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing chatbot resistance to prompt injection
• Auditing agent tool permissions and approval steps
• Checking retrieval access controls and memory poisoning

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts

Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing database exposure and TLS settings
• Checking account privileges and sensitive table access
• Assessing dangerous features and configuration weaknesses

Assess industrial control systems by mapping devices, network zones, and exposed protocols. The workflow prioritizes observing traffic and read-only checks, then organizes evidence about configuration weaknesses, firmware vulnerabilities, and potential effects on physical processes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map industrial devices and network zones
• Inspect captured industrial protocol traffic
• Review control system configurations offline

Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA permissions and configuration
• Checking code for embedded keys and tokens
• Observing app behavior with Frida or Objection

Trace how a web page generates request signatures and encrypted parameters by inspecting network requests and JavaScript execution. Collect runtime evidence, then use it to reproduce the behavior locally in Node.js.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing how request signatures are generated
• Finding the code that triggers a network request
• Capturing function inputs and outputs

Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Examining macOS application signatures and dependencies
• Investigating Objective-C and Swift program structure
• Tracing application behavior with lldb or Frida

Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing function calls and data flow in Binary Ninja
• Cross-checking findings from other disassemblers
• Automating binary analysis with the Python API

Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan a penetration test across multiple stages
• Assess how far a vulnerability could lead
• Replan from existing credentials or system access

Analyze custom virtual machines written in JavaScript by extracting instruction tables, examining constants, and capturing runtime state. Use the findings to reconstruct how obfuscated code executes, including custom runtimes used in risk-control engines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify a custom virtual machine in obfuscated JavaScript
• Extract and classify virtual machine instructions
• Trace exported functions and their execution flow

Analyze authorized browser extensions for Chrome, Edge, and Firefox. Inspect permissions, background scripts, storage, and network activity to reconstruct key data flows and explain credential handling, signing, encryption, or proxy behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review extension permissions and entry scripts
• Trace credential handling and network data flows
• Investigate suspicious or compromised extensions

Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose a specialist skill for an unfamiliar analysis task
• Route work spanning several security disciplines
• Record case scope and authorization before analysis

Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying open ports, services, and subdomains
• Scanning authorized targets for known vulnerabilities
• Validating web application security findings

Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review a bug bounty program's scope and testing rules
• Gather public information and discover target assets
• Plan API authorization and business logic checks

Analyze captured network traffic and binary messages to recover custom protocol structures. The skill organizes message types, fields, and connection states, then produces reproducible decoding steps with supporting evidence for authorized investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recover message fields from captured network traffic
• Investigate unknown Protobuf message structures
• Map handshakes, heartbeats, and connection states