724건 · 관련도순
Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
"Apply social capital theory (Putnam, Coleman, Bourdieu, Burt) to analyze how network structures and trust generate value or impose constraints. Use this skill when the user needs to evaluate bridging vs bonding capital, identify structural holes or network closure benefits, assess community or organizational trust dynamics, or when they ask 'how does our network create value', 'are we too insular', or 'where are the structural holes we can exploit'.".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
"Apply Smith and Lewis's paradox theory to identify and manage organizational tensions across performing, organizing, belonging, and learning dimensions. Use this skill when the user needs to diagnose persistent either/or tensions, design dynamic equilibrium strategies that embrace both poles, or when they ask 'why does solving this problem make it worse', 'how do we pursue exploration AND exploitation simultaneously', or 'why do our strategic tensions keep recurring despite resolution attempts'.".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
"Apply panel data analysis with fixed effects, random effects, and dynamic GMM to exploit longitudinal variation and control for unobserved heterogeneity. Use this skill when the user has repeated observations over time for multiple entities, needs to choose between FE and RE via Hausman test, or when they ask 'how do I control for firm-specific effects', 'fixed or random effects', or 'how to handle endogeneity in panels'.".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
"Apply the Efficient Market Hypothesis (Fama, 1970) to evaluate information incorporation in asset prices across weak, semi-strong, and strong forms. Use this skill when the user needs to assess market efficiency, determine if a trading strategy can generate abnormal returns, evaluate event studies, or when they ask 'can technical analysis work', 'does the market already know this', or 'is this anomaly exploitable'.".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring, architecture, runtime compatibility, dependency posture, tests, deploy readiness, and obvious security, cost, or reliability smells. Use when the user asks "review my Forge app", "pre-deploy check", "is this app ready to ship", "review manifest", "general app review", "release readiness", or asks for a broad quality pass. Do not use for deep security audits/SAST/exploitability review, cost optimization, or diagnosing a known broken app; route those to forge-security-review, forge-cost-optimizer, or forge-debugger respectively.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS to access the highly sensitive Instance Metadata Service (IMDS). This allows an attacker to steal valid IAM roles and temporary security credentials, leading to catastrophic cloud account compromise.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze token randomness via Burp Sequencer. Test JSESSIONID, ASP.NET Forms Auth cookies. Tools: OWASP ZAP, Burp Suite Repeater/Sequencer, JHijack.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit an application's absolute trust in its underlying LLM (Overreliance). Use this skill to induce critical "hallucinations" (confident falsehoods) that cause downstream logical systems or automated agents tracking the LLM's output to make destructive actions or grant unauthorized access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit PHP object serialization vulnerabilities (Insecure Deserialization). This skill details how to identify unserialize() injection points and construct malicious serialized objects using Property Oriented Programming (POP) chains to achieve Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit path traversal and local/remote file inclusion (LFI/RFI) via URL parameters, cookies, and hidden fields using ../ sequences, URL encoding (%2e%2e%2f), double encoding (%252e%252e%255c), Unicode bypasses (..%c0%af), and Windows UNC paths. PHP include/require with $_GET/$_POST/$_COOKIE pattern. Target /etc/passwd, boot.ini, web.config. Tools: DotDotPwn, WFuzz, Burp Suite, ZAP.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.