테스트 설계, 취약점 진단, 품질 보증 (1.3만건)
tespit etmerisky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates f...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
bu skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or aut...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etmeAWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credenti...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API gateway plugins, or application middleware, and implements proper HTTP 429 responses with Retry-After headers. Activates for requests involving rate limiting implementation, API t...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Parse Office 365 Unified Audit Logs via Microsoft Graph API to tespit etmeemail forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities where an authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. The tester intercepts API calls, identifies object ID parameters (numeric IDs, UUIDs, slugs), and systematically replaces them with IDs belonging to other users to Belirle: if the server enforces per-object authorization. This is OWASP API Security Top 10 2023 risk ...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etme (s) and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including AP...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token vali...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, Belirle:s enforcement mechanisms, and attempts bypasses including X-Forwarded-For spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests invol...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API Tespit, API inventory audit, or attack surf...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and Bul: security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication bypasses, resource leaks, and payload injection vulnerabilities. ...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etme (s) and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly Tespit. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft Tespit, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
bu skill teaches security teams how to tespit etmeand respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency Bul:ings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway a...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, aut...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etmeunusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tespit etme exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native Tespit mechanisms to prevent credential theft and unauthorized account access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.