테스트·보안 스킬

This playbook describes ways to establish remote command shells across Linux, Windows, and web servers. It covers encrypted connections, terminal upgrades for interactive use, file transfer options, PowerShell methods, and payload generation with msfvenom.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing reverse and bind shell approaches
• Making a limited shell interactive with a PTY
• Transferring files between Linux or Windows hosts

Start security reconnaissance on an unfamiliar application by confirming scope, mapping its attack surface, discovering related assets, and identifying technologies and endpoints. Use the resulting inventory to choose a focused first testing path instead of probing randomly.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Starting reconnaissance on a newly assigned application
• Building an endpoint and asset inventory
• Choosing the first security testing area

Check OAuth 2.0 and OpenID Connect login flows for configuration weaknesses. The playbook guides reviews of redirect URI checks, state and nonce validation, PKCE, token issuer and audience, scopes, and account binding across web, mobile, and SPA clients.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing OAuth or OIDC login flows
• Checking redirect URI and callback handling
• Comparing validation across web, mobile, and SPA clients

Plan movement between Windows hosts using remote execution methods such as PsExec, WMI, WinRM, DCOM, and RDP. The playbook compares credential requirements and operational traces, covers hash and Kerberos ticket use, and explains tunneling through a compromised host.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing remote execution options for Windows hosts
• Using an NTLM hash or Kerberos ticket to authenticate
• Choosing a method based on available credentials

A Windows security testing playbook covering ways attackers attempt to evade antivirus and endpoint detection tools. It organizes techniques involving AMSI, ETW telemetry, .NET assemblies, shellcode, process injection, API hooks, and signature checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Studying AMSI and ETW detection paths
• Reviewing endpoint defenses against .NET tools
• Assessing process injection and API hook detection

Use this playbook to test CDN, reverse proxy, and application caching for path confusion and cache key weaknesses. It helps distinguish flaws that expose authenticated responses from those that cause malicious content to be served to other users.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether authenticated pages are cached
• Testing path extensions and normalization differences
• Finding reflected headers missing from cache keys

Investigate why a web application firewall blocks an injection request and explore evasion methods for authorized security testing. The playbook covers encoding changes, HTTP protocol behavior, duplicate parameters, path normalization, content types, and WAF identification, with a decision process for choosing what to examine.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify which WAF is blocking a request
• Explore encoding variations in an authorized test
• Test duplicate parameter handling

Review file upload features across validation, storage, processing, and delivery. The playbook helps testers find issues such as unsafe previews, exposed files, cross-user overwrites, and risky document or media processing paths.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing file type and content validation
• Checking whether uploaded files are exposed or rendered unsafely
• Testing tenant boundaries, overwrite rules, and quotas

Assess exposed management services such as Redis, Rsync, PHP-FPM, AJP, Hadoop YARN, and H2 Console. The playbook covers discovery, service-specific checks, and configuration hardening for unauthenticated access risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing exposed Redis or Rsync services
• Checking PHP-FPM, AJP, or YARN access controls
• Reviewing H2 Console exposure and configuration

Use this playbook to investigate PCAP network captures with Wireshark and tshark. It covers protocol filters, traffic and file extraction, suspicious covert channels, capture repair, and TLS decryption workflows to help make recorded network activity understandable.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a PCAP from a security incident
• Filtering HTTP, DNS, or SMTP traffic
• Extracting files from a network capture

Use this playbook to inspect images, audio, files, and text for hidden data. It outlines format-specific checks and extraction approaches, from image metadata and audio spectrograms to embedded files, whitespace patterns, and invisible Unicode characters.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a PNG or JPEG for hidden content
• Inspecting audio for visual or encoded signals
• Finding appended data or polyglot files

Examine isolation boundaries in Python and Lua sandboxes, seccomp, chroot, containers, browser processes, and restricted shells. The playbook helps identify the sandbox type and assess escape paths that could expose files or permit code execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Classifying a sandbox in a CTF challenge
• Reviewing container or namespace isolation
• Investigating a restricted shell

Choose RSA cryptanalysis methods from the available parameters and observations. The playbook covers factoring weak moduli, small-exponent and shared-modulus attacks, partial information, padding oracles, and faulty signatures to help recover plaintext in CTFs or authorized assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recover plaintext from a weak RSA modulus
• Analyze ciphertexts encrypted with a small exponent
• Check multiple RSA moduli for shared factors

Use this security testing playbook to check whether proxies, CDNs, and origin servers disagree about HTTP request boundaries. It covers Content-Length and Transfer-Encoding differences, HTTP/2 downgrades, and browser-side desynchronization, with guidance for low-impact probes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a proxy and origin for HTTP boundary mismatches
• Investigating HTTP/2 to HTTP/1 downgrade behavior
• Exploring browser-side request desynchronization

Test JavaScript applications for prototype pollution, where untrusted keys alter shared object behavior. The playbook helps inspect parsers and merge operations, verify persistent effects, and assess whether later code paths turn the issue into a security impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing nested query or JSON input handling
• Reviewing unsafe object merge behavior
• Checking browser or Node.js prototype pollution impact

Investigate file path handling in downloads, includes, imports, and archive extraction. The playbook helps distinguish arbitrary file reads from local file inclusion, and maps common encoding, filter, platform, and PHP wrapper behaviors to test.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing file download endpoints for path traversal
• Reviewing template or include parameters
• Checking archive extraction paths for traversal

Use this skill to test applications that build NoSQL queries from user input. It covers MongoDB operator injection, authentication bypass, blind data extraction, aggregation pipelines, and Redis or CouchDB risks, with detection ideas and testing checklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing login forms backed by MongoDB
• Reviewing JSON filters for operator injection
• Checking aggregation pipeline inputs

Plan security assessments of network protocols such as ARP, name resolution, DHCPv6, VLANs, DNS, and IPv6. The guide explains how these techniques can expose credentials or redirect traffic, and helps select an approach based on network conditions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing protocol weaknesses on an authorized network
• Reviewing risks from name resolution and WPAD
• Planning tests for VLAN or IPv6 exposure

Use this skill to review JWT signing, keys, claims, bearer-token handling, and OAuth flows. It provides checks for token trust, account binding, redirects, and leakage paths, helping assess authentication weaknesses during authorized security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• JWTの署名方式や鍵の扱いを点検したいとき
• OAuthのstateやredirect_uriを確認
• トークンの権限クレームを検証

Evaluate macOS protections such as TCC, Gatekeeper, SIP, app sandboxing, and code signing in authorized security assessments. The playbook outlines bypass patterns, version considerations, entitlement checks, and persistence options.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing TCC access paths to protected files and devices
• Checking Gatekeeper and SIP behavior on macOS versions
• Reviewing sandbox escape and entitlement risks

Use this guide to inspect redirects controlled by URL parameters, form actions, or JavaScript. It outlines ways to find unsafe external redirects, check validation behavior, and understand how redirect issues can affect sign-in or server-side URL flows.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect parameters in a web application
• Checking whether URL validation can be bypassed
• Assessing redirect behavior in OAuth flows

Use this playbook to test web applications for race conditions, where simultaneous requests can pass a check before state changes. It covers one-time actions, balances, inventory, rate limits, and synchronized HTTP/1.1 or HTTP/2 testing, with evidence to confirm inconsistent results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing whether a reward or coupon can be claimed more than once
• Checking balances, quotas, or inventory under parallel requests
• Comparing rate limits for simultaneous and sequential attempts

Use this skill to examine ways code can enter macOS processes, including dynamic library loading, XPC services, Mach ports, and Electron apps. It outlines prerequisites and protections that affect each method, supporting security reviews and forensic investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing macOS apps for process injection risks
• Assessing XPC service client validation
• Checking Electron app security settings

Use this playbook to assess NTLM relay paths in Windows domain environments. It maps SMB, LDAP, HTTP, and MSSQL targets, explains signing and channel binding constraints, and covers ways to trigger authentication for authorized security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing NTLM relay exposure in a Windows domain
• Checking SMB and LDAP signing requirements
• Reviewing authentication coercion risks