'hunter' 검색 결과

Test CDN-backed websites for cache poisoning and Web Cache Deception, where private pages are mistakenly cached as public content. The skill guides cache behavior checks, input testing, and independent-client verification to establish reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing cache behavior on CDN-backed websites
• Checking whether private pages enter public caches
• Verifying cached responses influenced by headers

Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess permissions granted by discovered cloud credentials
• Review role trust and access across cloud accounts
• Check permissions assigned to anonymous Cognito identities

Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory Android apps included in a security assessment
• Check APKs for embedded credentials and internal API addresses
• Review components that other apps can invoke

Investigate IDOR, an access control flaw that exposes other users' resources through changed IDs. The skill guides REST API and GraphQL testing, checks boundaries between organizations, and helps document reproducible data exposure or unauthorized changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access controls between two user accounts
• Test data isolation between organizations
• Review GraphQL permissions for individual resources

Review access control, authentication flows, and configuration weaknesses across a service. The skill covers invitations, lingering sessions, token permissions, SAML sign-in, and internal APIs, with guidance for comparing response bodies and establishing concrete, reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check identity verification in invitation flows
• Verify access ends after organization membership removal
• Test enforcement of API token permissions

Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose a suitable Bugcrowd vulnerability category
• Explain a severity request using demonstrated impact
• Respond to out-of-scope decisions

Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review classic ASP.NET Webforms security
• Check exposure of trace and error logs
• Inspect WCF service metadata access

Organize a bug bounty investigation from reconnaissance through reporting. The skill helps choose a focused objective, identify the current phase, select relevant techniques and tools, and distinguish reproducible security impact from misleading test results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting objectives at the start of an investigation
• Choosing the next step when testing stalls
• Replanning after switching targets

Test whether user input becomes HTML markup in pages or notification emails instead of appearing as plain text. Use distinctive test markers to document reflected or stored injection, assess visible effects, and distinguish HTML injection from JavaScript execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check HTML handling in search results
• Inspect stored profile fields and comments
• Review HTML rendering in notification emails

Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate installed security tools and wordlists
• Plan reconnaissance within a program's scope
• Investigate related weaknesses and their combined impact

Investigate Next.js security issues across Server Actions, middleware, image optimization, and cached pages. Provides testing workflows for authentication bypass and data exposure, with checks to distinguish actual vulnerabilities from normal responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking authentication in Server Actions and middleware
• Testing image optimization for unintended server requests
• Inspecting page data for sensitive information

Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory exposed gRPC services and methods
• Check authentication and permissions on internal APIs
• Compare identity handling at proxies and backends

Assess login and verification code protections, identify response differences that reveal registered accounts, and distinguish visible blocks from silent throttling. The skill guides evidence gathering to verify weaknesses and assess their practical impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review login attempt limits
• Assess OTP and password reset protections
• Check whether responses reveal registered accounts

Test whether an application accepts forged JWTs, signed tokens that carry identity and role information. The skill covers signature bypasses, algorithm confusion, and untrusted keys, then guides verification of access to another user's data or protected functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing JWT signature verification
• Testing algorithm confusion and key handling
• Checking weak HMAC signing secrets

Investigate unsafe deserialization, where restoring objects from untrusted data can trigger code execution. The skill covers Java, PHP, Python, .NET, Ruby, and related patterns, with detection clues and callback-based checks for confirming execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding serialized data in cookies and request bodies
• Reviewing unsafe object restoration in source code
• Testing deserialization paths with language-specific tools

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Investigate file inclusion and path traversal flaws that let applications access unintended files. The skill guides checks for sensitive data exposure and possible code execution, using content evidence or repeatable indirect signals to avoid false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review download and template file paths
• Check whether file reads expose secrets
• Validate file access when content is not displayed

Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for a new bug bounty target
• Reviewing source code for security weaknesses
• Testing chatbot and AI feature security

Investigate cloud configuration weaknesses across AWS, GCP, and Azure, including public storage, exposed services, and leaked credentials. Find candidates in public information and JavaScript, then verify data access and permissions to establish practical impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking public access to S3, GCS, and Azure Blob storage
• Reviewing exposed serverless and managed services
• Assessing CloudWatch RUM guest role permissions

Review checkout, discounts, subscriptions, and verification flows for business logic flaws. The skill helps connect price manipulation, repeated credit redemption, skipped checks, and forged payment notifications to measurable financial loss, unauthorized access, or privacy impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review checkout prices and currency handling
• Check coupons and credits for repeated redemption
• Inspect email and phone verification flows

Review multi-factor authentication flows for skipped checks, reused one-time codes, weak backup paths, and verification races. It focuses on proving access to protected resources rather than relying on interface behavior or response codes alone.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access before completing multi-factor authentication
• Test one-time code reuse and validation behavior
• Review backup codes and trusted-device cookies

Test chatbots and AI agents for injected instructions, data leaks, and unauthorized access across accounts. It emphasizes reproducible evidence, verified external requests, and real data access rather than trusting the model's claims.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Test document-based prompt injection
• Verify data leaks through tools or rendered images
• Check data isolation between accounts

Review CORS, the browser rules governing access between websites, to find unsafe origin permissions on APIs. Verify whether an attacker-controlled site can read sensitive signed-in responses in a real browser, separating header warnings from demonstrated impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing CORS settings on signed-in APIs
• Checking trusted-origin matching rules
• Reproducing automated findings in a browser

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.