ajtazer

You are helping a penetration tester exploit misconfigured AD CS certificate

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect decompression bomb vulnerabilities where compressed input can expand to exhaust memory, targeting buffer-based decompression without size limits.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

curl -s 'https://TARGET-NAME.s3.amazonaws.com/?max-keys=10'

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hunt-llm-ai already owns *session-scoped* indirect injection — a hidden instruction in one

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester enumerate and exploit Microsoft

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect XML/SVG/YAML entity expansion (Billion Laughs) vulnerabilities in parsers that allow unbounded entity definitions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cross-pollination multiplier technique: find a vulnerability in one package, then search for the same pattern across all similar packages to multiply findings.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester exploit writable Group Policy Objects

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester force remote systems to authenticate

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are orchestrating a penetration test using Claude Code agent teams. You

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect code injection vulnerabilities in packages that dynamically generate or evaluate code via new Function(), eval(), vm.run*, or template literal interpolation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester exploit misconfigured Active Directory

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cross-cutting methodology for the CVE-hunting pipeline (ported from find-cve-agent): when a bug is design-vs-real, false-positive avoidance, version checking before reporting, responsible disclosure norms, acceptance-rate expectations per vuln class, vulnerability chaining playbook, known false-positive patterns, maintainer-response patterns, secure-pattern reference (what NOT to flag), and a self-criticism checklist to run before claiming a finding. Use this alongside the cve-hunter/cve-exploiter/cve-validator agents and the /cve-hunt pipeline — load it whenever judging if a finding is real, worth reporting, or already fixed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AI/LLM security offensive checklist: prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, LLM-assisted attack automation, and AI system reconnaissance. Use when assessing AI/ML systems, red-teaming LLMs, or researching AI attack vectors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester with offline credential and file cracking.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect method clobbering via user-controlled object keys that overwrite built-in methods like toString, valueOf, or hasOwnProperty, causing crashes or logic bypass.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use when recon shows `<tenant>.okta.com`, `<tenant>.okta-emea.com`, `<tenant>.oktapreview.com`, or autodiscover-style records pointing at Okta IdP.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect prototype pollution via object merge/clone/assign operations where __proto__ or constructor.prototype keys can modify Object.prototype.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester forge Kerberos tickets for domain

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester perform Kerberoasting (extracting TGS

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.