테스트·보안 스킬

Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing template rendering endpoints
• Identifying the template engine in use
• Evaluating information exposure and code execution risks

Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA files for endpoints and embedded secrets
• Observing app behavior and traffic with Frida
• Reviewing deep links and externally accessible components

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating privilege escalation in authorized Windows assessments
• Reviewing service and scheduled task permissions
• Checking detection coverage with attack and defense teams

Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing file checks before privileged operations
• Testing access revocation during long-running requests
• Investigating duplicate payments from concurrent requests

Assess WPA/WPA2 Personal Wi-Fi password strength through authentication data capture, file conversion, and offline password testing. Covers dictionary searches, pattern-based guesses, vendor default passwords, and capture quality checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Wi-Fi password strength
• Checking captured authentication data
• Reviewing vendor default password patterns

Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing client connections to rogue Wi-Fi
• Planning captive portal security exercises
• Reviewing conditions for traffic interception

Assess WPA3 wireless security by reviewing mixed WPA2/WPA3 settings and SAE, its password authentication method. Examine implementation weaknesses, H2E support, and 6 GHz requirements to determine relevant tests and detection signals.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing security settings on WPA3 wireless networks
• Assessing downgrade risks in mixed WPA2/WPA3 deployments
• Organizing SAE implementation and H2E checks

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Linux privilege escalation paths
• Practicing privilege escalation in CTF challenges
• Reviewing sudo and scheduled task configurations

Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning authorized phone and SMS security tests
• Reviewing visitor and badge verification procedures
• Designing USB device security exercises

Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Z-Wave smart home device security
• Mapping S0 and S2 security modes across devices
• Planning traffic capture during device pairing

Assess LoRaWAN and sub-GHz wireless devices by capturing signals, examining packet formats, and checking key reuse and replay weaknesses, where recorded messages are resent. It covers IoT networks, fixed-code remotes, and proprietary radio protocols.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing LoRaWAN keys and frame counters
• Testing fixed-code remotes for replay weaknesses
• Analyzing proprietary wireless packet formats

Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing JWT authentication in a web app
• Checking signature and key validation
• Reviewing token storage in mobile apps

Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing web application inputs for SQL injection
• Reviewing GraphQL and WebSocket injection risks
• Combining SQLmap automation with manual verification

Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map GraphQL endpoints and data structures
• Check access controls across users and roles
• Review query limits and subscription security

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping paths to administrative access in Active Directory
• Reviewing ADCS certificate service configurations
• Assessing permissions, delegation, and group policies

Plan and run fuzz testing, which feeds varied inputs to software to uncover bugs. The skill guides tool selection, test harness creation, input collection, coverage measurement, and crash triage for parsers, protocols, kernels, and other targets.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning fuzz tests for a file parser
• Preparing test harnesses and seed inputs
• Investigating stalled test coverage

Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review secret exposure in build environments
• Search build logs and caches for leaked credentials
• Assess trust settings between pipelines and cloud services

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify authentication methods on enterprise Wi-Fi
• Review client validation of authentication server certificates
• Assess EAP-TLS certificate storage and issuance

Turn penetration test and red team results into reports for executives and technical teams. Structure findings, explain severity scores and business impact, organize evidence, and document remediation steps and retest plans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing a final penetration test report
• Rewriting an executive summary for nontechnical readers
• Creating a reusable security reporting template

Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized phishing exercise
• Preparing sending infrastructure and landing pages
• Reviewing email, QR code, and callback scenarios