'attack' 검색 결과

Webサービスを攻撃者目線でレビューし、実在する攻撃ベクターに基づいて脆弱性を発見・整理するスキル。 静的レビューと実証検証は別サブエージェントに委任し、メインセッションは両者の結果を 査読・比較して次アクションを判断する。Medium以上の実証済み所見、または実証未了でも 優先度が高い所見がある場合はメインセッションで対策プランの作成を促す。 Trigger: 脆弱性レビュー, セキュリティ診断, 攻撃者目線レビュー, ペネトレーション観点, /dev:attack-surface-review, attack surface review, pentest perspective, exploit path

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation from operators. It addresses PLC logic integrity monitoring, physics-based process anomaly detection, engineering workstation compromise indicators, USB-borne attack vectors, and multi-stage attack chain detection spanning IT-to-OT lateral movement through to process manipulation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Social engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, authority and urgency psychological triggers, rapport building), vishing (voice phishing via caller ID spoofing, IVR system exploitation, VoIP infrastructure setup with Twilio/Asterisk), smishing (SMS-based phishing, carrier gateway abuse, short code impersonation), physical social engineering (tailgating and piggybacking, RFID badge cloning with Proxmark3, lock picking and bypass, dumpster diving for sensitive documents), USB drop attacks (Rubber Ducky keystroke injection, Bash Bunny multi-vector payloads, O.MG cable covert implants, BadUSB firmware attacks), watering hole attack planning and execution, and OSINT-driven targeting (LinkedIn harvesting, organizational chart reconstruction, employee pattern analysis). Integrates with the Social Engineering Toolkit for attack automation, Proxmark3 for RFID/NFC cloning, USB Rubber Duc...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and byte-at-a-time decryption, hash length extension attacks against SHA1/SHA256/MD5-based MACs using HashPump, RSA vulnerabilities including small public exponent, common modulus, Bleichenbacher PKCS1v1.5 padding oracle, and Coppersmith's method for partial key recovery. Addresses weak PRNG exploitation targeting time-seeded generators and Mersenne Twister MT19937 state recovery from observed outputs, timing side-channel attacks against comparison operations, nonce reuse in AES-GCM leading to authentication key recovery, and key derivation weaknesses including insufficient iteration counts and missing salts. Primary tooling includes padbuster, RsaCtfTool, hashpump, and PyCryptodome for building c...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Compare code structure across two commits, tags, or directories to identify security-relevant changes. Produces a report on new attack paths, privilege boundaries, complexity, and how widely a change could affect other functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare code structure before a release
• Investigate new attack paths after code changes
• Track untrusted data flows across a refactor

Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing cryptographic code against known attacks
• Comparing results across cryptographic libraries
• Investigating rejected or incorrectly accepted signatures

Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess dependency confusion risks in package registry settings
• Review tampering risks in CI/CD artifacts and container images
• Plan a non-destructive proof of concept and remediation report

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Create Three.js game effects that clearly communicate attacks, hits, damage, and status changes. Define each effect’s purpose and lifetime, limit resource use, and test overlapping effects, repeated triggers, low-quality settings, and reduced-motion alternatives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Distinguish attack warnings from hit effects
• Create damage and status feedback
• Limit particle counts during repeated attacks

Build and tune enemy behavior for action games, including targeting, movement, attacks, retreats, and boss phases. Organize decisions into explicit states, make attacks readable to players, and check behavior with repeatable tests and browser encounters.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implementing enemy detection, pursuit, and retreat
• Tuning attack warnings and combat spacing
• Debugging boss phases and interrupted actions

Build and check monsters for Three.js and web action games using shared rules for joints, attachment points, collision shapes, and combat states. Separate visual animation from damage decisions, and provide reproducible checks for attacks and detail-level changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Standardizing joints and attachment points across monsters
• Connecting attack timing with collision and damage handling
• Reproducing combat states and attack phase boundaries

Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping an organization's externally exposed assets
• Recording evidence sources and confidence levels
• Prioritizing exposures within a limited research budget

Review SAML single sign-on, where services exchange signed identity information, for signature and identity handling flaws. The skill guides testing and validation to determine whether altered assertions can change accounts, roles, or access decisions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review SAML single sign-on flows
• Test signature validation and XML interpretation
• Check whether identity or role changes affect access

Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.