'misconfiguration' 검색 결과

Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA files for endpoints and embedded secrets
• Observing app behavior and traffic with Frida
• Reviewing deep links and externally accessible components

Test web APIs, authentication, and LLM features with six Python scanners. Check cross-site access rules, header injection, database inputs, and signed login tokens, then investigate hidden server behavior through external callbacks and chatbot responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking CORS and response-header behavior
• Testing NoSQL logins and JWT authentication
• Confirming hidden bugs through external callbacks

Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review TLS certificates and encryption settings
• Assess DNS records for subdomain takeover
• Validate email spoofing evidence

Review CORS, the browser rules governing access between websites, to find unsafe origin permissions on APIs. Verify whether an attacker-controlled site can read sensitive signed-in responses in a real browser, separating header warnings from demonstrated impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing CORS settings on signed-in APIs
• Checking trusted-origin matching rules
• Reproducing automated findings in a browser

Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate prototype pollution in Node.js APIs
• Check Express proxy trust and IP restrictions
• Review template rendering and command execution inputs

Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking public access to S3, GCS, and Azure Blob storage
• Reviewing exposed serverless and managed services
• Assessing CloudWatch RUM guest role permissions

Assess SSH services by discovering servers, reviewing encryption settings, testing passwords and keys, and investigating known vulnerabilities. Includes guidance on SSH tunnels and port forwarding, with reports covering configuration, authentication weaknesses, and forwarding setups.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering SSH services and reviewing encryption settings
• Assessing password and private key authentication
• Checking known SSH vulnerabilities and misconfigurations

Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating Windows privilege escalation paths
• Checking service permissions and stored credentials
• Assessing token privileges and missing patches

Understand common web application vulnerabilities through organized explanations of their causes, impacts, and mitigations. Use the reference to review authentication, APIs, access controls, and configuration issues, or build checklists for security assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Learning vulnerability types and their causes
• Building a web security assessment checklist
• Reviewing authentication and API weaknesses

Assess Linux systems for weaknesses that let a regular user gain administrator access. Guides inspection of permissions, scheduled tasks, and vulnerable components, with findings, evidence, and remediation recommendations documented for review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Linux permissions and configuration
• Checking sudo and SUID privilege escalation paths
• Reviewing scheduled tasks and shared directories

Structure authorized cloud security tests covering access permissions, exposed storage, metadata services, and serverless environments. This skill helps agents stay within scope, consider alternative investigation paths, and collect evidence for findings and completion decisions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of an authorized cloud security test
• Organize evidence for permission and storage findings
• Consider other paths when cloud checks stall

Guide authorized checks of CORS, the browser rules for sharing resources across sites. Define testing boundaries, assess origin handling and credential exposure, and organize reproduction evidence or reports explaining what was tested without finding a vulnerability.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Define the scope of a CORS configuration review
• Review allowed origins and credential exposure
• Organize evidence for a reproducible finding

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization. Trigger with 'audit access control', 'check permissions', or 'validate authorization'.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Code review and validation for CloudBase projects. After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill to check for known pitfalls — auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse. Supports automated lint scripts (regex-based) + LLM semantic review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill should be used when the user asks to "analyze Terraform modules", "scan IaC for security issues", "review Terraform configurations", "check infrastructure code for misconfigurations", or "audit cloud resources".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, SSRF. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' or wants to check their codebase for common security weaknesses.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.