103건 · 관련도순
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Build an initial target profile from a domain, URL, or IP address by collecting availability, ports, services, subdomains, and technology details. Produces factual inputs for known vulnerability lookups and decisions about subsequent security testing.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Plan and run a multi-language or multi-region site. Use this skill when adding new locales, choosing URL structure for languages (subfolders vs subdomains vs ccTLDs), implementing hreflang, planning translation workflow, handling currency and date formats, designing for RTL languages, or auditing a stalled internationalization rollout. Triggers on internationalization, i18n, localization, l10n, hreflang, multi-language, translation workflow, RTL, locale, ccTLD, subfolder vs subdomain, language switcher. Also triggers when international audiences underperform or translations are stale.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep OSINT reconnaissance using the MITRE ATT&CK Reconnaissance framework. Email harvesting with SMTP verification, subdomain takeover detection, certificate transparency mining, Shodan/Censys intelligence, Wayback Machine historical analysis, social media profiling, cloud storage enumeration, document metadata extraction, DNS history, credential leak checks, and passive infrastructure mapping. Uses theHarvester, amass, dnsrecon, fierce, dnstwist, dmitry, whatweb, wafw00f, exiftool, metagoofil, smtp-user-enum, swaks, waybackurls, subfinder, and crt.sh. Pure reconnaissance — no active exploitation. Produces: confidence-scored findings, infrastructure diagram, employee roster, email pattern confirmation, subdomain takeover candidates. Chains into /pentester for active testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and map the external corporate footprint of a target organization. Use this skill at the absolute beginning of an engagement (Reconnaissance) to identify all registered domains, subdomains, IP ranges, and Autonomous System Numbers (ASNs) owned by the target. This skill forms the foundation for all subsequent external penetration testing and attack surface management.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Passive domain reconnaissance using Python stdlib. Use this skill for subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required. Triggers on requests like "find subdomains", "check ssl cert", "whois lookup", "is this domain available", "bulk check these domains".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
- Enumerate an organisation's subdomains and sibling domains from Certificate Transparency logs and passive DNS, without sending traffic to the target. Use when looking for staging, dev, admin or VPN hosts, mapping the full hostname footprint of a domain, or spotting infrastructure a company forgot it had
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
업무 영역별로 코드를 나누는 DDD의 기본 구조를 만듭니다. 각 계층과 공개용 파일을 구성하고 생성 결과를 도메인 모델 그래프와 작업 메모리에 기록합니다.
Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Monitor public certificate issuance records to find suspected phishing domains, brand lookalikes, and unauthorized certificates. Use crt.sh for historical searches and Certstream for live alerts, then summarize suspicious findings and detection reasons in a report.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Configure OAuth, the authorization flow used for provider sign-in, with portless development URLs. It guides callback registration and authentication library settings, helping diagnose rejected domains, redirect URL mismatches, and callbacks that point to the wrong address.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze business concepts in a codebase to map business areas and suggest service boundaries. Use Domain-Driven Design, an approach organized around business meaning, to classify responsibilities, assess how closely they belong together, and recommend clearer integration points.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.