10건 · 관련도순
Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Detect and exploit SQL injection vulnerabilities using both manual techniques and automated tools. Use this skill when testing web applications for database injection flaws including UNION-based, error-based, blind boolean, blind time-based, and out-of-band SQL injection. Covers WAF bypass, second-order SQLi, authentication bypass, and full database extraction with sqlmap.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the `alg` header set to `none`, allowing attackers to forge tokens without a valid signature.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit implementations of JSON Web Tokens (JWT) through algorithmic confusion (e.g., RS256 to HS256), "none" algorithm attacks, and signature stripping. Use this skill to forge administration tokens and achieve unauthenticated Account Takeover (ATO) on REST APIs and modern web applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.