테스트·보안 스킬

Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and exploit SQL injection vulnerabilities using both manual techniques and automated tools. Use this skill when testing web applications for database injection flaws including UNION-based, error-based, blind boolean, blind time-based, and out-of-band SQL injection. Covers WAF bypass, second-order SQLi, authentication bypass, and full database extraction with sqlmap.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Plan and execute authorized phishing and social engineering campaigns for red team engagements. Use this skill when conducting simulated social engineering attacks including email phishing, spear phishing, vishing, pretexting, and credential harvesting. Covers GoPhish setup, pretext development, payload delivery, and measuring human vulnerability. Requires explicit written authorization before any testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Extract sensitive training data and internal capabilities from AI models through repeated programmatic querying. Use this skill when testing LLMs and ML models for data privacy leaks, intellectual property exposure, or unintended memorization. Covers membership inference, prompt extraction, training data reconstruction, and API boundary testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when testing APIs and web frameworks for mass assignment vulnerabilities where user-controlled request body fields are bound directly to model attributes without a field allowlist. Trigger on: ORM update/create endpoints, REST APIs accepting JSON body, Rails strong parameters, Django model forms, Laravel fillable/guarded, Node.js Mongoose/Sequelize, PUT/PATCH requests, registration endpoints, profile update endpoints, GraphQL mutations. Detects privilege escalation via role/admin/isAdmin fields, plan upgrades via subscription fields, and horizontal access via ownerId/userId injection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identify Open Redirect vulnerabilities where applications route users to arbitrary external URLs based on unvalidated input. Prove maximum impact by chaining Open Redirects with OAuth token theft, SSRF, or Phishing, graduating this typically low-risk finding into a high-severity report.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Internal network assessment. VLAN hopping, ARP spoofing detection, broadcast protocol abuse (LLMNR/NBT-NS/mDNS), network segmentation verification, SNMP enumeration, NFS exposure, router/switch audit, and internal service mapping. Assumes attacker has network access. Uses nmap, arp-scan, nbtscan, snmpwalk, onesixtyone, smbmap, nfs-common, masscan, hping3, and netexec.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects authentication and biometric bypass vulnerabilities in mobile apps (Android/iOS). Trigger on: BiometricPrompt, LocalAuthentication, LAContext, evaluatePolicy, CryptoObject, Android Keystore, Secure Enclave, kSecAccessControlBiometryCurrentSet, userAuthenticationValidityDurationSeconds, confirmCredentials, biometric fallback, PIN bypass, passive authentication, enrolled biometrics detection, Frida hook auth, jailbreak bypass, TouchID, FaceID, fingerprint. Covers MASVS-AUTH-1/2/3.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit validation and exploitation using Metasploit Framework. Runs in a dedicated Docker container (separate from Kali). Validates CVEs discovered by nuclei, nikto, or other scanners with actual exploit modules. Covers exploit selection, payload configuration, exploitation, and post-exploitation pivoting. Uses msfconsole, msfvenom, and the Metasploit module database. Chains from /pentester, /analyze-cve, or /post-exploit when exploitable CVEs are confirmed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform advanced network scanning and service enumeration using Nmap for penetration testing and security assessments. Use this skill when conducting network reconnaissance, port scanning, service version detection, OS fingerprinting, and vulnerability scanning. Covers stealth scanning, firewall evasion, NSE script usage, and network mapping for infrastructure penetration tests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.