'vulnerabilities' 검색 결과

Test CDN-backed websites for cache poisoning and Web Cache Deception, where private pages are mistakenly cached as public content. The skill guides cache behavior checks, input testing, and independent-client verification to establish reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing cache behavior on CDN-backed websites
• Checking whether private pages enter public caches
• Verifying cached responses influenced by headers

Assess Laravel applications for exposed secrets, accessible dashboards, and authentication or permission flaws. The skill guides checks of debug settings, signed URLs, cookies, and model updates, with validation criteria for understanding the impact of findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Laravel debug settings and exposed configuration files
• Checking access controls on Telescope and Horizon dashboards
• Testing signed URLs and unintended profile field updates

Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking legacy login endpoints left outside SSO controls
• Reviewing token trust between partner and admin portals
• Mapping authentication paths across websites and APIs

Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review GitHub Actions workflows for unsafe execution paths
• Investigate Jenkins exposure and affected versions
• Check logs, artifacts, and container images for leaked secrets

Investigate IDOR, an access control flaw that exposes other users' resources through changed IDs. The skill guides REST API and GraphQL testing, checks boundaries between organizations, and helps document reproducible data exposure or unauthorized changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access controls between two user accounts
• Test data isolation between organizations
• Review GraphQL permissions for individual resources

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Investigate GraphQL APIs for unauthorized data access, unsafe updates, and permission inconsistencies with REST APIs. The skill covers schema discovery, checks across users and organizations, and validation steps that turn suspected weaknesses into reproducible findings with concrete impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map GraphQL schemas and sensitive operations
• Check access boundaries between users and organizations
• Compare permission changes across REST and GraphQL

Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate prototype pollution in Node.js APIs
• Check Express proxy trust and IP restrictions
• Review template rendering and command execution inputs

Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory exposed gRPC services and methods
• Check authentication and permissions on internal APIs
• Compare identity handling at proxies and backends

Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review checkout prices and currency handling
• Check coupons and credits for repeated redemption
• Inspect email and phone verification flows

Assess GraphQL APIs in financial services for unauthorized transfers, rounding errors, duplicate transactions, and exposed personal data. The skill guides checks of account permissions and ledger changes to distinguish actual financial impact from misleading success responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing transfer and withdrawal permissions
• Checking rounding and duplicate transaction handling
• Inspecting access to identity verification data

Review access control, authentication flows, and configuration weaknesses across a service. The skill covers invitations, lingering sessions, token permissions, SAML sign-in, and internal APIs, with guidance for comparing response bodies and establishing concrete, reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check identity verification in invitation flows
• Verify access ends after organization membership removal
• Test enforcement of API token permissions

Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect validation in social login
• Checking state and nonce validation
• Investigating mobile login links

Audit a repository or broad subsystem for security, correctness, and maintenance risks. Trace how inputs reach affected behavior, verify suspected defects, and report confirmed findings with severity, triggers, impact, and practical remedies.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing risks across a repository
• Checking state loss and resource limits in a TUI
• Checking dependencies for known vulnerabilities

Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing suspected SQL injection in an authorized web application
• Inspecting database, table, and column structures
• Testing POST requests captured with Burp Suite

Guides security scanning across networks, web applications, wireless systems, and cloud environments. Helps select and configure tools, check findings for false positives, prioritize risks, and prepare reports with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering hosts, open ports, and services
• Assessing web application vulnerabilities
• Reviewing cloud security settings

Use Shodan to investigate internet-exposed devices and services on authorized targets. Guidance covers web searches, command-line tools, and APIs to compile asset inventories, review known vulnerability information, monitor networks, and export findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying an authorized organization's exposed services
• Finding services associated with known vulnerabilities
• Reviewing exposed IoT devices and management interfaces

Review web application code against OWASP Top 10 (2021), a list of common security risks. Receive findings with file locations, severity ratings, concrete fix code, and a prioritized list of remediation tasks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a project's OWASP Top 10 security coverage
• Checking code for SQL injection and XSS
• Inspecting authentication and access controls

Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Windows privilege escalation paths
• Checking service permissions and stored credentials
• Assessing token privileges and missing patches

Learn how to conduct an authorized penetration test, a security assessment that checks exploitable weaknesses. Follow guidance from initial research and scanning through validation, evidence collection, and reporting with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Learning the full penetration testing lifecycle
• Planning research and scanning for an authorized assessment
• Organizing vulnerability evidence

Assess web application login and session security, including password rules, multi-factor authentication, and password resets. The skill guides testing and documents weaknesses, session behavior, and recommendations for strengthening authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing password rules and login attempt limits
• Checking session expiration and logout behavior
• Assessing multi-factor authentication and account recovery

Plan and coordinate penetration tests with checklists covering objectives, scope, environment preparation, tester selection, monitoring, and follow-up. Helps teams define deliverables, prioritize vulnerabilities, arrange fixes and verification, and clean up test accounts and artifacts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining penetration test objectives and scope
• Preparing test environments and monitoring
• Selecting testers and agreeing on report requirements

Map an authorized target's subdomains, active websites, and technologies, then organize vulnerability checks with security tools. The skill covers reconnaissance workflows, automated scans, and XSS testing for flaws that let injected scripts run in web pages.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discover subdomains and active websites within an approved scope
• Identify technologies and hidden API endpoints
• Build a repeatable reconnaissance pipeline

Audit sensitive code and dependencies for security weaknesses, then verify fixes with tests and repeat checks. Reports identify severity, file locations, and remediation steps for issues involving authentication, data protection, injection attacks, and configuration.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing authentication and access controls
• Auditing payment processing code
• Checking dependencies for known vulnerabilities