'credentials' 검색 결과

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Server-Side Request Forgery (SSRF) vulnerabilities to extract AWS IAM credentials from the Instance Metadata Service version 2 (IMDSv2). This skill details how to bypass the token requirement of IMDSv2 by chaining HTTP verbs (PUT then GET) if the SSRF vulnerability allows full control over the request headers and methods.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Chanjing AI creation Open API client: submit image/video tasks, poll task status, list and get tasks, and optionally download outputs when the user runs download_result.py. Reads and writes local credentials.json; calls open-api.chanjing.cc.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Generate accurate Volcengine SDK examples by locating an API through API Explorer search, fetching its swagger, and calling api/common/explorer/make-code with user-provided Params. Use when the user asks how to write Volcengine SDK code, generate SDK samples, or call a Volcengine API in Python, Go, Java, PHP, cURL, Node.js. Supports Chinese and English API names such as "角色扮演", "AssumeRole", or "STS AssumeRole". Also use for explicit SDK configuration questions about retry, timeout, AK/SK, STS, AssumeRole, temporary credentials, proxy, connection pooling, SSL, debug mode, request signing, response parsing, and error handling. If the user only needs API parameters, enum values, required fields, error codes, response schemas, pagination, or API comparisons, hand off to volcengine-api. If they need CLI-based operations, hand off to volcengine-cli.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guides developers through Google Ads API quickstart: credential setup, choosing from 6 client libraries/REST, configuring environments, and running a "retrieve campaigns" script. Troubleshoots common setup errors: USER_PERMISSION_DENIED, login_customer_id issues, and DEVELOPER_TOKEN_NOT_APPROVED. Use this skill when: - The user asks how to get started with the Google Ads API. - The user needs to set up Google Ads credentials or developer tokens. - The user wants to write a quickstart/example script for Google Ads. - The user encounters errors like USER_PERMISSION_DENIED or DEVELOPER_TOKEN_NOT_APPROVED.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find default credentials", or GKE metadata server unreachable) by verifying cluster and node-pool Workload Identity configuration, the Kubernetes ServiceAccount (KSA) to IAM binding (direct principal binding and legacy Google ServiceAccount impersonation), target-resource IAM roles, and gke-metadata-server health. Use when a Pod cannot authenticate to Google Cloud APIs even though Workload Identity is expected to be in effect. Don't use for in-cluster Kubernetes RBAC errors (API-server authorization), general workload crashes (use gke-workload-troubleshooting), or Workload Identity setup and hardening (use gke-workload-security).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when configuring Remote Site Settings to allow Apex callouts to external URLs, or distinguishing them from CSP Trusted Sites for Lightning component resource loading. NOT for storing an endpoint and its auth as a Named Credential — use integration/named-credentials-setup. NOT for allow-listing a URL the browser itself loads (script, iframe, fetch) — use security/csp-and-trusted-urls.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when setting up or auditing a dedicated Salesforce integration user — Salesforce Integration user license, API-only profile, permission set layering, MFA waiver, and login monitoring. NOT for creating human users, roles, or login hours — use admin/user-management. NOT for login IP ranges, session lifetime, or OAuth client-credential hardening — use security/api-only-user-hardening. Trigger keywords: service account, API-only user, run-as user, client credentials execution user, LoginHistory, REQUEST_LIMIT_EXCEEDED, integration login failure.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill to select the right Salesforce integration pattern — from point-to-point to event-driven to hub-and-spoke — by applying the official Salesforce two-axis decision framework (integration type × timing) to a business integration scenario. Trigger keywords: integration pattern decision, choose integration approach, Salesforce integration architecture, when to use platform events vs API, integration type selection. NOT for implementation of any specific integration pattern (use domain-specific integration skills), MuleSoft architecture (use architect/mulesoft-anypoint-architecture), or middleware vendor selection. More triggers: integration decision record, Bulk API vs REST for a nightly load, external Id upsert, Named Credential vs Remote Site Setting, platform event vs CDC, who calls whom.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when designing deployable Salesforce configuration with Custom Metadata Types, especially when choosing between CMTs, Custom Settings, and Custom Objects, protecting packaged defaults, or exposing config to Apex, Flow, and formulas. Triggers: 'custom metadata vs custom settings', 'deployable config', 'protected custom metadata', 'feature flags in Salesforce'. NOT for hierarchical Custom Settings resolution, getInstance/getValues, or their SOQL cost — use admin/custom-metadata-types-and-settings. NOT for high-churn transactional or user-managed business records — use admin/object-creation-and-design. NOT for secrets — use integration/named-credentials-setup. More trigger keywords: __mdt, CustomMetadata .md file, customMetadata folder, getInstance, getAll, xsi:type, visibility PackageProtected, MetadataRelationship, EntityDefinition field, $CustomMetadata.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when choosing between Custom Metadata Types and Custom Settings, understanding hierarchical vs list settings, deployment behavior, governor limit implications, or accessing either from Apex and Flow. Trigger keywords: 'custom metadata vs custom settings', 'hierarchical settings per user profile', 'deployable config vs runtime settings', 'getValues getInstance in apex', 'flow get records custom settings'. NOT for modelling the CMT itself or protecting packaged defaults — use admin/custom-metadata-types. NOT for records users edit as business data — use admin/object-creation-and-design. NOT for secrets — use integration/named-credentials-setup. More trigger keywords: customSettingsType, customSettingsVisibility, SetupOwnerId, getOrgDefaults, getAll, DUPLICATE_VALUE in test, SeeAllData custom settings, enableAdvancedCSSecurity, customSettingAccesses, org default profile user override.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Router for the 61 SfSkills `integration` skill packages. INBOUND integration and the API surface itself: the Salesforce REST and SOAP APIs, Bulk API 2.0 jobs, Platform Events, CDC, Pub/Sub, Named Credentials and middleware. For calling OUT to someone else's API from Apex, use salesforce-apex instead. Use when the request mentions integration, Salesforce REST API, composite API, SOAP API, Bulk API 2.0 job, Platform Event, Change Data Capture, Pub/Sub, inbound webhook, Named Credential, OAuth, connected app, MuleSoft, Salesforce Connect, external system calling Salesforce. Finds and opens the exact skill package to read; it does not contain the guidance itself.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit codebases for leaked secrets and hardcoded credentials, generate .env templates, configure secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, set up credential rotation, and integrate secrets into CI/CD pipelines via OIDC federation

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

BE Dev (Backend Developer) agent. Reads BA + TechLead + PM artifacts and generates backend source code files, .env.example, and pr-description.md. No hardcoded credentials. Part of the Virtual Team Skill pipeline.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects review-blocking configuration issues including sub-1.0 version numbers, beta in app name, staging endpoints, and missing demo credentials that prevent reviewers from evaluating the app, violating Guidelines 2.1 and 2.3.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects placeholder content, stub UI, hardcoded test credentials, and non-production endpoints that signal an incomplete app to reviewers under Guideline 2.1.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.