188건 · 관련도순
Harden Angular apps against XSS, CSP violations, and unauthorized access. Use when implementing XSS protection, Content Security Policy, or auth guards in Angular.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
在授权渗透测试中挖掘 JavaScript 原型污染（prototype pollution，服务端 Node.js 与客户端）。当目标把用户可控的键名递归合并进对象（merge/extend/set/clone、JSON body、query 解析）时使用——典型场景：用 `__proto__`/`constructor.prototype` 注入属性，污染全局原型，进而 DoS、改逻辑、配合 gadget 提权到 XSS/RCE。适用目标类型 Web / REST API（Node.js） / 前端。触发场景包括用户说"测下原型污染""这个 merge 能不能 __proto__""污染原型打 RCE/XSS""lodash/jquery 有没有污染点"。输出：污染点 + 可用 gadget 判定 + 反射证据的 finding（含 killed 记录）。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
When hardening a web application against Cross-Site Scripting (XSS) and injection attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
JavaScript prototype pollution — Object.prototype'u kirleterek auth bypass, RCE, XSS gadget chains (server-side Node.js ve client-side)
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
包括的なPerlセキュリティ — テイントモード、入力バリデーション、安全なプロセス実行、DBIパラメータ化クエリ、Webセキュリティ（XSS/SQLi/CSRF）、perlcriticセキュリティポリシー。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Djangoセキュリティベストプラクティス、認証、認可、CSRF対策、SQLインジェクション防止、XSS防止、セキュアなデプロイ設定。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection points, unsafe DOM manipulation, and improper sanitization.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifies and fixes XSS, SQL injection, and command injection vulnerabilities with validation schemas, sanitization libraries, and safe coding patterns. Use for "input validation", "XSS prevention", "SQL injection", or "sanitization".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
인증, 결제, API 코드를 구현하고 검토할 때 보안 점검 항목과 구현 예시를 제공합니다. 입력 검증, 접근 권한, 비밀 정보 관리, 요청 제한과 로그의 민감 정보 노출을 확인합니다.
Review a website’s Content Security Policy, which controls allowed resources, and identify unsafe HTML insertion. Guide policy changes and sanitization, then verify actual HTTP responses and browser behavior in a production-like environment.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Review pending code changes for newly introduced security vulnerabilities with clear exploitation paths. Focus on concrete, significant risks and filter likely false alarms, then report affected files, line numbers, severity, attack scenarios, and recommended fixes in Markdown.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze Apache and Nginx access logs for attack attempts, scanner activity, and repeated login requests. Add geographic context to source IP addresses and produce a prioritized findings report to support intrusion investigations and monitoring reviews.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Create or modify Handsontable cell renderers, functions that control cell appearance. It guides safe text and HTML handling, accessible cell attributes, content placement, and caching choices for expensive rendering work during scrolling and redraws.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.