'pentest' 검색 결과

Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing an API from its specification
• Checking data access across tenants
• Verifying restrictions on administrator routes

Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Fixing vulnerabilities reported by Strix
• Prioritizing remediation by severity
• Retesting original exploits after code changes

Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code and infrastructure security
• Mapping threats with STRIDE or PASTA
• Planning stronger security settings

Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate UART, JTAG, and SWD debug interfaces
• Collect and document boot logs
• Assess secure boot and encrypted flash

Analyze firmware from routers, cameras, and other IoT devices, from extracting internal files to running services in an emulator. Follow a staged workflow to investigate vulnerabilities and reproduce findings with firmware analysis and testing tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing router or camera firmware
• Inspecting firmware update packages
• Running firmware without physical hardware

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing API access across user roles
• Checking token handling and request rate limits
• Assessing GraphQL access control and data exposure

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Gathering public information before a penetration test
• Finding unknown internet-facing assets
• Checking public sources for leaked credentials and documents

Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing damage possible after a workstation compromise
• Reviewing Active Directory paths to higher privileges
• Testing internal network security controls

Map sensitive data across the systems you manage, explore what a compromised asset could expose, and maintain a risk register. Record likelihood, impact, owners, mitigations, and review dates to support ongoing security planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locating sensitive data across managed systems
• Assessing the impact of a compromised server or worker
• Recording risk owners, mitigations, and review dates

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning smart home device security tests
• Analyzing firmware for embedded secrets
• Assessing industrial device communications

Plan and carry out wireless security assessments, from surveying nearby networks to checking authentication weaknesses and recording findings. Covers personal and enterprise Wi-Fi, rogue access points, and testing considerations for Wi-Fi 6, 6E, and 7.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning a corporate Wi-Fi security assessment
• Reviewing WPA2 and WPA3 authentication weaknesses
• Testing enterprise Wi-Fi against rogue access points

Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA files for endpoints and embedded secrets
• Observing app behavior and traffic with Frida
• Reviewing deep links and externally accessible components

Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing security risks during system design
• Assessing an inherited codebase without its owner
• Refining a code-based draft with the application owner

Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the impact of exposed cloud credentials
• Reviewing paths to higher cloud privileges
• Checking storage access with benign test objects

Assess SSH services by discovering servers, reviewing encryption settings, testing passwords and keys, and investigating known vulnerabilities. Includes guidance on SSH tunnels and port forwarding, with reports covering configuration, authentication weaknesses, and forwarding setups.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering SSH services and reviewing encryption settings
• Assessing password and private key authentication
• Checking known SSH vulnerabilities and misconfigurations

Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing suspected SQL injection in an authorized web application
• Inspecting database, table, and column structures
• Testing POST requests captured with Burp Suite

Assess WordPress security using WPScan and related tools. Identify versions, themes, plugins, and exposed user information, then examine known vulnerabilities, configuration problems, and weak passwords to produce assessment findings and evidence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying WordPress versions, themes, and plugins
• Checking known vulnerabilities and configuration problems
• Assessing exposed user information and weak passwords

Assess AWS security through penetration testing, a process for checking exploitable weaknesses. Examine IAM permissions, storage, compute resources, and credential exposure to identify privilege escalation paths and document security audit findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review IAM permissions for privilege escalation paths
• Assess S3 bucket access and exposed files
• Check credential exposure through EC2 metadata

HackerOne bounty program scope-guard workflow — reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.