'obfuscation' 검색 결과

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros

Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing data transfer channels for an authorized exercise
• Planning compression, encryption, and file splitting
• Verifying received files against SHA-256 records

Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare C2 frameworks for a red team exercise
• Plan communication methods and relay infrastructure
• Review C2 detection signals from a defender's perspective

Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), isolating user-mutable sign inputs (timestamp/nonce/deviceId/body) vs constants (secret key), hooking fetch/XHR in DevTools, JS deobfuscation basics (webpack/wasm/JSVMP), and the bounty payoff: reach the protected API to then hunt IDOR/auth/business-logic. Use when Burp/mitmproxy replay of a signed or anti-bot-gated request fails and you suspect a client-computed field is blocking you.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Domain routing and boundary guidance for authorized reverse engineering analysis, including decompilation, debugging, protocol reversing, firmware extraction, and deobfuscation. Use when a task belongs to the reverse engineering domain and needs scope, evidence, pivot, or exit criteria.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Domain routing and boundary guidance for authorized defense evasion and bypass testing, including WAF bypass, AV/EDR evasion, logging considerations, and traffic obfuscation. Use when a task belongs to the evasion domain and needs scope, evidence, pivot, or exit criteria.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or understanding software protection mechanisms.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit an AI agent skill before installing it. Use proactively whenever the user is about to add, install, enable, or evaluate an unfamiliar skill — including phrases like "audit this skill", "is this skill safe", "scan skill before install", "check skill for malicious code", "review this plugin", or any pre-install gate on an untrusted, third-party, or community-distributed skill bundle. Runs ten categories of static checks (code execution, network exfiltration, credential harvesting, persistence, prompt injection, supply-chain hooks, obfuscation, destructive filesystem ops, secrets, Trojan Source / homoglyphs) and emits a PASS / WARN / FAIL verdict.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Configure release signing, R8 obfuscation, and App Bundle publishing for Android. Use when setting up signing configs, enabling minification, adding ProGuard keep rules, or preparing for Play Store submission.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Secure storage, certificate pinning, biometric auth, jailbreak detection, code obfuscation, network security, screenshot prevention for React Native

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run post-merge release build steps for this repository, including Android tag-driven releases and sequential iOS IPA generation with archival for Transporter upload and Crashlytics deobfuscation. Use after the release PR has been merged.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects weak reverse engineering and tampering protections in mobile apps (Android/iOS). Trigger on: root detection bypass, jailbreak detection bypass, Frida detection, debugger detection, anti-debugging, ptrace, sysctl, emulator detection, code obfuscation absent, debug symbols present, get-task-allow, ProGuard disabled, R8 disabled, string encryption, integrity check, file tampering, repackaging, dynamic instrumentation, runtime hook, Magisk hide, Magisk, frida-server, objection bypass, signing verification, apk resign. Covers MASVS-RESILIENCE-1/2/3/4.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses symbolic execution (angr) to solve constraint-based malware problems — finding inputs that reach a target branch, recovering keys/passwords from a check routine, and brute-forcing opaque predicates — by generating a ready-to-edit angr harness. Activates for requests to use symbolic execution, solve a malware unlock check with angr, or recover an input that reaches a code path.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from a process memory dump by locating decrypted config structures and decoding common obfuscation layers. Activates for requests to extract malware config from a memory dump, recover C2 settings from a running sample, or decode an in-memory configuration block.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. Activates for requests to deobfuscate JavaScript, decode obfuscated JS, or analyze a malicious script dropper.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes legacy Excel 4.0 (XLM) macro malware by parsing extracted macro-sheet formulas for auto-executing names, obfuscation (FORMULA.FILL, CHAR concatenation), and download or execution primitives (EXEC, CALL, REGISTER). Activates for requests to analyze XLM macros, examine Excel 4.0 macro sheets, or deobfuscate legacy spreadsheet macros.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes malicious Office documents by extracting and reviewing VBA macros and OLE/OOXML structure: auto-exec triggers, obfuscation, dropped payloads, and shell/PowerShell invocation. Activates for requests to analyze a malicious Word/Excel document, VBA macro, or maldoc.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.