테스트·보안 스킬

Use this playbook to test web applications for race conditions, where simultaneous requests can pass a check before state changes. It covers one-time actions, balances, inventory, rate limits, and synchronized HTTP/1.1 or HTTP/2 testing, with evidence to confirm inconsistent results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing whether a reward or coupon can be claimed more than once
• Checking balances, quotas, or inventory under parallel requests
• Comparing rate limits for simultaneous and sequential attempts

Use this playbook to assess SQL injection risks when application input reaches database queries. It explains behavioral tests, database-specific clues, blind and out-of-band techniques, second-order cases, and situations where parameterized queries leave dynamic query parts exposed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a form input affects a SQL query
• Investigating blind injection with no visible output
• Reviewing dynamic sorting or filtering parameters

Use this playbook to assess NTLM relay paths in Windows domain environments. It maps SMB, LDAP, HTTP, and MSSQL targets, explains signing and channel binding constraints, and covers ways to trigger authentication for authorized security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing NTLM relay exposure in a Windows domain
• Checking SMB and LDAP signing requirements
• Reviewing authentication coercion risks

Use this Linux security playbook to assess ways an intruder with initial host access could move to other systems. It covers SSH agents and keys, credential locations, internal network tunnels, D-Bus services, shared filesystems, sudo sessions, and systemd services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping lateral movement paths during an authorized Linux assessment
• Checking SSH keys and agent access across hosts
• Reviewing credentials exposed in histories and configuration files

Use this playbook to study Linux kernel vulnerabilities such as use-after-free, out-of-bounds access, and races. It covers QEMU and GDB setup, exploit primitives, kernel protections, return-oriented programming, and common paths for privilege escalation in CTF or authorized research.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up a QEMU environment to debug a kernel exploit
• Classifying a kernel bug and choosing an exploitation primitive
• Studying how SMEP, SMAP, KASLR, or KPTI affect an exploit

Use this guide to inspect redirects controlled by URL parameters, form actions, or JavaScript. It outlines ways to find unsafe external redirects, check validation behavior, and understand how redirect issues can affect sign-in or server-side URL flows.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect parameters in a web application
• Checking whether URL validation can be bypassed
• Assessing redirect behavior in OAuth flows

Use this skill to review JWT signing, keys, claims, bearer-token handling, and OAuth flows. It provides checks for token trust, account binding, redirects, and leakage paths, helping assess authentication weaknesses during authorized security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• JWTの署名方式や鍵の扱いを点検したいとき
• OAuthのstateやredirect_uriを確認
• トークンの権限クレームを検証

Test LLM applications for direct and indirect prompt injection, unsafe tool use, data leaks, and MCP risks. The playbook covers ways to probe defenses and trace how untrusted inputs can affect model actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether user prompts can override system instructions
• Testing RAG, browsing, or email inputs for hidden instructions
• Reviewing tool calls and MCP servers for data leak paths

Assess Kubernetes cluster exposure through the API server, RBAC permissions, service accounts, etcd, Kubelet, and cloud metadata. The playbook also covers pod escape paths, admission controls, network policies, and container registry secrets for security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Kubernetes API and RBAC exposure
• Checking service account permissions and accessible secrets
• Reviewing cloud metadata and Kubelet access paths

Assess SAML single sign-on implementations by reviewing signed assertions, audience and recipient checks, ACS handling, replay protections, account mapping, and XML parser behavior. Use it to organize authorized tests of enterprise login flows and trust boundaries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing which SAML assertion elements are signed
• Checking audience, recipient, and ACS validation
• Comparing SP-initiated and IdP-initiated login flows

Investigate 401 and 403 responses on restricted paths by testing path variations, HTTP methods, headers, and protocol versions. The playbook also describes combining checks and using scanners to identify access control inconsistencies.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating 403 responses on admin paths
• Testing API access controls across methods and headers
• Scanning restricted routes for inconsistent responses

Assess container escape risks in authorized security tests across Docker, LXC, and Kubernetes. Review privileges, capabilities, mounted Docker sockets, namespaces, cgroups, and runtime weaknesses to identify paths that could expose the host.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a privileged container configuration
• Checking a mounted Docker socket for host escape risk
• Assessing Kubernetes pod settings for host access

Assess Android apps during authorized security reviews. The playbook covers intercepting pinned HTTPS traffic, checking exposed components and WebViews, testing intent redirection and root detection, and examining overlays, app backups, and stored data for weaknesses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing Android apps during an authorized assessment
• Reviewing exported components and deep links
• Checking WebView settings and app backups

Assess iOS app security during authorized mobile testing. The playbook helps inspect Keychain items and stored data, test custom URL schemes and Universal Links, examine binary protections and transport settings, and use Frida or Objection for runtime analysis across jailbroken and non-jailbroken setups.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect an app’s Keychain and local data
• Test URL scheme and Universal Link handling
• Analyze binary protection settings

Use this API testing playbook to check whether users can access or change objects and functions beyond their permissions. It guides comparisons between two accounts, nested resource checks, alternate HTTP methods, and attempts to write hidden fields such as roles or verification flags.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether one account can read another's records
• Testing authorization on nested resources and alternate methods
• Finding writable fields that should be restricted

Use this skill to triage security issues in file downloads, paths, uploads, previews, and archive extraction. It helps identify where a file workflow is affected and routes the investigation to path traversal or upload validation topics.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing download endpoints and file path handling
• Investigating upload, preview, or extraction workflows
• Choosing between path traversal and upload validation checks

Use this testing playbook to determine whether a page can be embedded in an iframe and whether framing protections are configured correctly. It covers clickjacking proof of concepts, multi step actions, frame busting scripts, and checks for sensitive actions that could be triggered through deceptive page overlays.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking framing protections on account and admin pages
• Testing whether sensitive actions can be triggered through an iframe
• Reviewing X-Frame-Options and CSP frame-ancestors settings

Test how web applications and proxies use the HTTP Host header for URL generation, routing, caching, and access checks. The playbook covers password reset poisoning, cache poisoning, internal routing, virtual host discovery, and ways to assess validation behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking password reset links for host injection
• Testing cache behavior when the Host value changes
• Finding internal virtual hosts by changing Host

Assess misconfigured Active Directory Certificate Services for paths to privilege escalation or lasting access. The playbook covers certificate template weaknesses, enrollment relays, CA permissions, and certificate based authentication techniques.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing AD CS templates for escalation paths
• Checking enrollment endpoints for NTLM relay exposure
• Reviewing CA permissions and certificate based persistence risks

Use this skill to assess email features for header injection and spoofing risks. It explains how to inspect user supplied fields, email authentication settings, and message rendering, helping identify weaknesses in contact forms, password resets, and email APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing contact forms that send email
• Assessing password reset messages
• Checking email APIs for header injection

This playbook explains dangling markup injection, a way HTML injection can expose content that appears later in a page even when JavaScript is blocked. It covers conditions, browser behavior, possible data exposure, and limitations for security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing HTML injection when scripts are blocked
• Checking whether page content after an injection point is exposed
• Comparing browser behavior for dangling markup

Use this playbook to review DeFi protocols for flash loan, price oracle, governance, bridge, and token-standard risks. It explains how MEV (value extracted by transaction ordering), rounding errors, and other attack patterns can affect protocol behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing lending and vault contracts for price manipulation
• Checking governance for flash-loan voting risks
• Assessing bridge message verification and replay protection

Use this playbook to assess whether a website’s CORS settings let another origin read authenticated API responses. It guides checks for reflected or weakly validated origins, credential handling, preflight rules, null origins, and cache behavior that can expose sensitive data.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether an API reflects arbitrary Origin headers
• Reviewing credentialed browser access to authenticated endpoints
• Testing origin allowlists and preflight policies for mistakes

Assess whether user supplied input can reach shell commands or other process execution points. The playbook covers common entry points, different quoting contexts, and ways to detect blind injection when the application does not show command output.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing input passed to shell commands
• Checking converters and import workflows for injection
• Detecting blind command execution without visible output