Zhao

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts

Analyze Android apps in a CTF sandbox using static inspection and Frida hooks, which observe or alter running code. Trace request signing, local storage, and Java-to-native boundaries to reproduce a request accepted by the server.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing request-signing inputs and outputs
• Inspecting Java-to-native calls with runtime hooks
• Examining app settings, databases, and token storage

Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating executable files and libraries
• Tracing processing from strings and function calls
• Organizing analysis with comments and meaningful names

Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating and auditing a software component inventory
• Prioritizing dependency vulnerabilities by actual exposure
• Auditing CI/CD pipelines and secret handling

Study authorized wireless devices beyond conventional Wi-Fi using SDR, software-defined radio. Identify signal characteristics, analyze protocols, and assess replay feasibility in shielded labs to evaluate unauthorized control risks and develop hardening recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify signals from authorized remotes and sensors
• Analyze legally received ADS-B or remote-control protocols
• Assess replay feasibility in a shielded laboratory

Analyze captured network traffic and binary messages to recover custom protocol structures. The skill organizes message types, fields, and connection states, then produces reproducible decoding steps with supporting evidence for authorized investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recover message fields from captured network traffic
• Investigate unknown Protobuf message structures
• Map handshakes, heartbeats, and connection states

Automate website navigation, form filling, content collection, and Windows desktop interactions. The skill selects browser or desktop tools for the task and guides screenshot capture and desktop network traffic observation when needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Automating website login and form entry
• Collecting page content and screenshots
• Operating Windows desktop applications

Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check public phishing reports for a suspicious domain
• Investigate scam or impersonation leads from public posts
• Prepare verified evidence for a security investigation

Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious executables, scripts, and macros
• Extracting malicious domains, file paths, and other indicators
• Creating YARA and Sigma detection rules

Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate UART, JTAG, and SWD debug interfaces
• Collect and document boot logs
• Assess secure boot and encrypted flash

Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing EDR detection coverage in authorized exercises
• Examining internal monitoring mechanisms
• Testing an in-house implant against security products

Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing pull request changes for security issues
• Checking scanner findings for false positives
• Investigating authorization and injection flaws

Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing database exposure and TLS settings
• Checking account privileges and sensitive table access
• Assessing dangerous features and configuration weaknesses

Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review a bug bounty program's scope and testing rules
• Gather public information and discover target assets
• Plan API authorization and business logic checks

Analyze binaries with Ghidra to locate important functions, follow references, and inspect decompiled code, a readable approximation of the original program. Support both interactive investigation and automated batch analysis without a graphical interface.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing binaries when an IDA license is unavailable
• Locating important functions through strings and imported APIs
• Running batch decompilation or analysis in CI

Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK entry points, components, and permissions
• Locating login, signing, and certificate checks
• Editing smali code and rebuilding an APK

Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Developing exploit code for a known vulnerability
• Investigating why a CTF exploit fails remotely
• Checking library versions and memory protections

Analyze firmware from routers, cameras, and other IoT devices, from extracting internal files to running services in an emulator. Follow a staged workflow to investigate vulnerabilities and reproduce findings with firmware analysis and testing tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing router or camera firmware
• Inspecting firmware update packages
• Running firmware without physical hardware

Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing untrusted content into agent tool actions
• Comparing deployment configuration with live behavior
• Following dependencies and artifacts through CI/CD

Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect certificate templates and enrollment rights
• Trace certificate issuance to accepted authentication
• Identify configuration weaknesses behind granted privileges

Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing function calls and data flow in Binary Ninja
• Cross-checking findings from other disassemblers
• Automating binary analysis with the Python API

Route CTF, attack-and-defense competition, and practice-lab tasks through initial scope checks to a dedicated orchestrator. This entry skill hands off specialist selection while preserving priority for more specific pwn, APK, or IDA routes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Starting a CTF task with an unclear problem type
• Routing attack-and-defense competition tasks
• Initializing work in a lab or offline environment

Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose a specialist skill for an unfamiliar analysis task
• Route work spanning several security disciplines
• Record case scope and authorization before analysis

Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing chatbot resistance to prompt injection
• Auditing agent tool permissions and approval steps
• Checking retrieval access controls and memory poisoning