스킬 찾기

Guide authorized tests for server-side template injection, where input is evaluated as template code. This skill defines investigation boundaries, alternative checks, and the evidence needed to support findings across engines such as Jinja2 and Twig.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized template injection test
• Review template execution evidence and engine identification
• Consider other checks when template tests stall

Coordinate authorized web application security testing by routing potential weaknesses to specialist skills. Keep testing within the target scope, organize supporting evidence, and combine individual test results into a comprehensive report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing specialist skills for potential web vulnerabilities
• Prioritizing multiple areas for security testing
• Combining test evidence into a comprehensive report

Assess candidate CVEs, identifiers for known vulnerabilities, against observed software, versions, and patch evidence. The skill helps determine whether to continue verification, gather more information, or change testing direction within the authorized scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether candidate CVEs match observed software
• Reviewing patch status before further testing
• Identifying evidence gaps that require more reconnaissance

Guides authorized OS command injection testing by defining scope, alternative investigation paths, and evidence requirements. Helps agents document direct, blind, and argument injection findings and report inconclusive results without overstating what the evidence proves.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining the scope of command injection testing
• Reviewing investigation paths when responses are absent
• Organizing reproduction evidence and execution privileges

Guide authorized security reconnaissance, the collection of information about a target. Set investigation boundaries, identify alternative sources when discovery stalls, and organize domains, ports, services, and findings for prioritizing further security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of authorized reconnaissance
• Find alternative sources when discovery stalls
• Organize domains, IP addresses, ports, and services

Guides authorized network security testing of exposed services, weaker communication protocols, interception risks, and network segmentation. Helps agents set investigation boundaries and document network structure, demonstrated weaknesses, reachable systems, and reasons for inconclusive results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining the scope of network security testing
• Reviewing exposed services and protocol weaknesses
• Assessing network segmentation and reachable systems

Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Decoding strings with multiple layers of encoding
• Calculating hashes and checking likely hash formats
• Encrypting or decrypting data with a known key

Find specialist playbooks for internal network penetration testing after initial access is established. Covers movement between hosts, credential collection, privilege escalation, persistent access, tunneling, and assessments involving Active Directory, certificate services, Exchange, and SharePoint.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan internal network testing after gaining initial access
• Find playbooks for movement between hosts and credential collection
• Review privilege escalation and persistent access test areas

Guides authorized testing of XXE, a flaw involving external references processed in XML. Helps agents set boundaries, reconsider blocked test paths, and document evidence of file access or server requests before drawing conclusions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining the scope of XXE testing
• Reviewing XML entry points in uploaded files
• Organizing evidence of entity processing and external requests

Guide authorized testing of open redirects, where a site sends visitors to an unintended destination. This skill defines test boundaries, alternative investigation paths, and the evidence needed to report findings or conclude an investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized redirect test
• Review evidence for OAuth redirect_uri findings
• Choose another direction when redirect checks stall

Read a HackerOne program’s testing scope and rules, distinguish report eligibility from bounty eligibility, and pass supported assets to pentest-flow for security testing. Prepare separate findings in HackerOne report format for manual submission while enforcing scope and impact limits.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Organizing allowed and excluded assets from a program
• Distinguishing report eligibility from bounty eligibility
• Testing one supported asset at a time within program rules

Plan security tests for websites and AI agents using vulnerability cases and risk frameworks. The skill selects relevant references, develops test hypotheses, and separates suspected issues from confirmed findings with source citations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan an authorized web penetration test
• Assess prompt injection and MCP risks
• Develop test hypotheses for a CTF challenge

Structure authorized cloud security tests covering access permissions, exposed storage, metadata services, and serverless environments. This skill helps agents stay within scope, consider alternative investigation paths, and collect evidence for findings and completion decisions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized cloud security test
• Organize evidence for permission and storage findings
• Consider other paths when cloud checks stall

Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose RSA approaches from the given parameters
• Investigate weaknesses in AES modes
• Analyze random number sequences for predictability

Guide authorized cross-site scripting testing, where injected scripts run in a web page. Define test boundaries, choose alternative investigation paths, and document reproduction evidence before reporting findings or ending an inconclusive investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized XSS assessment
• Choose another investigation path when checks stall
• Organize reproduction steps and script execution evidence

Guide the scope, next checks, and evidence requirements for authorized CSRF testing, which examines unwanted requests sent through a user's browser. Covers token protection, SameSite cookie controls, and JSON requests, including reporting when evidence is insufficient.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of a CSRF assessment
• Review next checks when CSRF protections block testing
• Organize reproduction evidence and impact findings

Guide authorized subdomain takeover assessments involving DNS records that point to unclaimed resources. The skill defines boundaries, suggests further checks, and specifies evidence for takeover feasibility, potential impact, or a report of unsuccessful investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized subdomain takeover assessment
• Investigate DNS records pointing to deleted services
• Organize evidence of takeover feasibility and potential impact

Guide authorized testing of security defenses, including web application firewalls, antivirus, and endpoint detection tools. The skill defines scope, alternative testing directions, evidence requirements, and completion criteria for reporting successful bypasses or unsuccessful attempts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define scope for authorized security defense testing
• Choose another direction when testing stalls
• Organize evidence for a successful bypass

Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Capture Android app traffic during real user flows
• Investigate browser request signatures and tokens
• Analyze desktop client signing logic

Guides reconnaissance across servers, websites, and domains, combining public-source research with technical checks. Produces a structured Markdown report and adds author or personnel research when explicitly requested or when the site identifies an author.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating server ports and software versions
• Identifying website technology and exposed files
• Researching DNS records and subdomains

Find tools and command options for an established security testing task. References span 14 categories, including reconnaissance, web testing, password testing, privilege escalation, and tunneling, helping you compare candidates and recall how to use them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding tools for an identified vulnerability type
• Looking up command arguments you do not remember
• Comparing candidate tools for the same testing task

Quickly find test input families, checks, and validation priorities once a security testing direction is known. Covers web vulnerabilities, authentication, AI, and MCP, with pointers to specialist skills and reference material.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recall initial checks for a known vulnerability type
• Choose test input families and validation priorities
• Find reference cards for AI and MCP testing

Guide authorized testing of login, authorization, and sessions, including passwords, JWT tokens, OAuth, and multifactor authentication. The skill helps define boundaries, select alternative investigation paths, and document evidence needed to support findings or report unsuccessful tests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define scope for login and session security testing
• Organize checks for JWT, OAuth, and multifactor authentication
• Document requests and evidence supporting an authentication bypass

Guide systematic security testing of Web applications and APIs across input handling, authentication, business rules, protocols, files, and deployment settings. Use topic-specific references and playbooks, or step-by-step testing guides, to choose checks suited to the target.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning input validation and injection testing
• Checking authentication and access control
• Reviewing GraphQL, WebSocket, and OAuth security