150건 · 관련도순
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Hunt fintech-specific GraphQL vulnerabilities: money-movement mutations (transfers, redemptions, withdrawals, card top-ups), ledger/balance/portfolio query IDOR, decimal-precision and rounding abuse, idempotency-key bypass enabling double-spend, KYC/PII field-level authorization gaps, and admin-override mutations reachable via mass assignment. Distinct from hunt-graphql, which owns generic GraphQL discovery and IDOR/mutation methodology — this skill owns the delta introduced when a GraphQL layer sits in front of a ledger, wallet, payments, banking, brokerage, or lending backend, where a resolver bug moves real money instead of just leaking data. Use when hunting a fintech, banking, payments, wallet, neobank, brokerage, or lending target that exposes a GraphQL API, or when a schema/response includes balance, transfer, ledger, redeem, quote, KYC, or account-linking fields.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA/IDOR, function-level authorization, mass assignment and tenant scoping
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Broken Object Level Authorization (BOLA), historically known as Insecure Direct Object Reference (IDOR), in API architectures. Extremely common and critical flaw where an API fails to validate whether the currently authenticated user actually owns or retains permissions over the specifically requested database resource (ID).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etmeand prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Structure server-side applications with practical patterns for Node.js, Express, and Next.js API routes. Covers API design, database queries, caching, authentication, error handling, and background jobs, with examples that separate business rules from data access.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Support legal questions concerning Brazilian law across family, criminal, labor, tax, consumer, real estate, business, civil, and constitutional matters. The skill directs the agent to consult an accompanying detailed guide for procedures, prerequisites, and validation requirements.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.