테스트·보안 스킬

Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API Tespit, API inventory audit, or attack surf...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API gateway plugins, or application middleware, and implements proper HTTP 429 responses with Retry-After headers. Activates for requests involving rate limiting implementation, API t...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Office 365 Unified Audit Logs via Microsoft Graph API to tespit etme
email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration using PCR-based condition keys, and secure vsock communication channels. The practitioner builds enclave images, configures attestation-aware KMS policies, validates attestation documents against the AWS Nitro PKI root of trust, and establishes isolated computation pipelines for processing sensitive data such as PII, cryptographic keys, and healthcare records. Activate...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

tespit etme
risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to tespit etme
overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud Dağıt:ment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and Bul: security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication bypasses, resource leaks, and payload injection vulnerabilities. ...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement API Security Posture Management to continuously discover, classify, and score APIs based on risk while enforcing security policies across the API lifecycle.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway a...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Performs GraphQL introspection attacks to Şunu çıkar: full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testi...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Tespit etme exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native Tespit mechanisms to prevent credential theft and unauthorized account access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implementing AWS Config rules for continuous compliance monitoring of AWS resources, Dağıt:ing managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute and Şunu test et: JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credenti...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

tespit etme
unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

bu skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have Erişim: by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment ...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Tespit etme data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty Bul:ings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, aut...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

tespit etme (s) and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly Tespit. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft Tespit, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.