'xss' 검색 결과

Security-Scanner Agent fuer fabrikIQ und andere Projekte. Fuehrt umfassende Sicherheitspruefungen durch. Trigger bei: (1) Pre-commit Validation, (2) PR-Creation, (3) Weekly Security Audits, (4) Nach Dependency-Updates, (5) Vor Production Deployments. <example> Context: User moechte vor einem Commit sicherstellen, dass keine Secrets committed werden. user: "Ich will gleich committen. Pruefe mal auf Secrets." assistant: "Ich starte den security-scanner Agent, um den Code auf API Keys, Tokens und andere Secrets zu pruefen." <Task tool call to security-scanner agent> </example> <example> Context: Weekly Security Audit des fabrikIQ-Projekts. user: "Fuehre den woechentlichen Security-Scan durch." assistant: "Ich fuehre einen vollstaendigen Security-Scan durch: Secret Detection, Dependency Audit, OWASP Patterns, Security Headers und Rate Limiting." <Task tool call to security-scanner agent> </example> <example> Context: User hat Dependencies aktualisiert und will Vulnerabilities pruefen. user: "Ich habe npm update und pip install -U gemacht. Gibt es Sicherheitsprobleme?" assistant: "Ich scanne die aktualisierten Dependencies auf bekannte Vulnerabilities mit dem security-scanner Agent." <Task tool call to security-scanner agent> </example> <example> Context: PR-Review mit Security-Fokus. user: "Review den PR #42 auf Security-Probleme." assistant: "Ich analysiere die geaenderten Dateien im PR auf Security-Patterns: SQL Injection, XSS, Hardcoded Credentials und fehlende Input-Validation." <Task tool call to security-scanner agent> </example>

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audits token storage mechanisms to prevent XSS-based JWT theft.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement comprehensive security patterns to protect applications against OWASP Top 10 vulnerabilities including XSS, CSRF, SQL injection, authentication bypass, and data exposure. Use when handling user data, implementing authentication and authorization, validating input, encrypting sensitive data, preventing injection attacks, securing API endpoints, managing sessions and tokens, implementing rate limiting, configuring security headers, or building security-critical features that require defense-in-depth protection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Use PROACTIVELY for frontend security implementations or client-side security code reviews.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hardens .NET apps per OWASP Top 10 -- injection, auth, XSS, deprecated security APIs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implements security headers and Content Security Policy with safe rollout strategy (report-only → enforce), testing, and compatibility checks. Use for "security headers", "CSP", "HTTP headers", or "XSS protection".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester exploit stored (persistent) cross-site

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester exploit reflected cross-site scripting. The

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are helping a penetration tester exploit DOM-based cross-site scripting. The

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

File upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link poisoning, routing SSRF, OAuth issuer) is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

DOM-based attacks execute in the victim's browser — the server often never sees the payload, so WAFs and server-side input filters do not apply. PostMessage missing-origin-check = cross-origin token theft with no XSS needed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Dependency confusion / supply chain (internal package-name discovery, unclaimed-name confirmation, callback-only PoC, npm/pip/Maven/RubyGems variants). Use when hunting a specific vuln class or studying what makes bugs pay.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.