'exploitation' 검색 결과

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious periodic connections
• Measuring the volume and destination of data transfers
• Tracing attacker movement between internal systems

Retrieve security findings from Google Cloud Security Command Center for initial assessment. Filter active vulnerabilities, threats, and external exposures, inspect one finding’s full details, or group counts by category to understand the reported risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Retrieving full details for a named security finding
• Listing active vulnerabilities or external exposures
• Summarizing active finding counts by category

Map sensitive data across the systems you manage, explore what a compromised asset could expose, and maintain a risk register. Record likelihood, impact, owners, mitigations, and review dates to support ongoing security planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locating sensitive data across managed systems
• Assessing the impact of a compromised server or worker
• Recording risk owners, mitigations, and review dates

Assess smart-home and commercial mesh networks, where devices relay communications. Covers Zigbee, Thread, and Matter, with methods for observing radio traffic, reviewing device setup and key handling, and testing exposure of lighting, locks, and sensors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning a smart-home mesh security assessment
• Reviewing Zigbee lighting and lock controls
• Checking Thread network credential handling

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing file checks before privileged operations
• Testing access revocation during long-running requests
• Investigating duplicate payments from concurrent requests

Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing server protocols, encryption settings, and certificates
• Reviewing certificate validation in mobile apps
• Assessing TLS 1.3 replay risks and mutual authentication

Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing template rendering endpoints
• Identifying the template engine in use
• Evaluating information exposure and code execution risks

Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access controls across users and roles
• Review token lifecycles and request limits
• Assess gRPC and WebSocket security

Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized phishing exercise
• Preparing sending infrastructure and landing pages
• Reviewing email, QR code, and callback scenarios

Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code that restores objects from external data
• Identifying serialized data in cookies and request bodies
• Assessing message consumers and admission webhooks

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess dependency confusion risks in package registry settings
• Review tampering risks in CI/CD artifacts and container images
• Plan a non-destructive proof of concept and remediation report

Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing web application inputs for SQL injection
• Reviewing GraphQL and WebSocket injection risks
• Combining SQLmap automation with manual verification

Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning smart home device security tests
• Analyzing firmware for embedded secrets
• Assessing industrial device communications

Supports authorized security exercises that test data transfer outside a network. Organizes channel choices, compression, encryption, splitting, and receipt verification, alongside the monitoring signals defenders can use to identify different transfer methods.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing data transfer channels for an authorized exercise
• Planning compression, encryption, and file splitting
• Verifying received files against SHA-256 records

Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare C2 frameworks for a red team exercise
• Plan communication methods and relay infrastructure
• Review C2 detection signals from a defender's perspective

Hunt for signs of compromise in web and application logs without an initial alert. Establish normal activity, record investigative hypotheses, check source code, and reproduce issues locally before producing incident records and a report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for compromise without an initial alert
• Tracing related activity across application logs
• Distinguishing attack attempts from successful exploitation

Turn raw security findings into a ranked list for engineering review. Check claims against source code, merge duplicates, assess how feasible exploitation is, and assign component owners, with results in JSON and Markdown.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validating security scanner findings
• Merging duplicate findings across scans
• Prioritizing a vulnerability backlog

Post-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers IAM enumeration and privilege escalation (iam:PassRole, CreatePolicyVersion, AssumeRole chains, GCP service-account impersonation, Azure managed-identity abuse), IMDSv1/v2 metadata credential theft, STS token abuse, S3/GCS/Blob bucket takeover and object exfil, Lambda/Cloud Functions env-var secrets, cross-account and cross-service pivoting, and turning leaked keys into demonstrated impact (read PII, assume admin, exfil data). Assumes authorized scope only. Use when you have AWS/GCP/Azure keys, an SSRF hitting 169.254.169.254 / metadata.google.internal, a leaked service-account JSON, or a token, and need to escalate and prove impact. For finding buckets/origins first, use cloud-recon; for the SSRF entry point, see web2-vuln-classes. 中文触发词：云渗透、AWS提权、IAM枚举、元数据凭证、云安全审计

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection enumeration via Picker.aspx, NTLM Type-2 AD topology disclosure, custom-branding module discovery, EoL farm permanent-CVE-window exploitation, FormDigest anonymous issuance, file-extension blocklist NOT-an-oracle pattern, custom-zone Forms auth bridging on-prem AD. Use when target has SharePoint headers (SPRequestGuid, X-MS-InvokeApp, X-SharePointHealthScore, MicrosoftSharePointTeamServices) or paths (/_layouts/15/, /_vti_bin/, /_api/, /_catalogs/).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.