'authorize' 검색 결과

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prepare selected pull requests for maintainer review by comparing failures with their current base, fixing authorized defects, and preserving contributor credit. Report complete or partial validation with evidence and outstanding checks before any separately authorized merge.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing selected pull requests before merging
• Distinguishing base failures from PR defects
• Fixing authorized defects while preserving contributor credit

Study authorized wireless devices beyond conventional Wi-Fi using SDR, software-defined radio. Identify signal characteristics, analyze protocols, and assess replay feasibility in shielded labs to evaluate unauthorized control risks and develop hardening recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify signals from authorized remotes and sensors
• Analyze legally received ADS-B or remote-control protocols
• Assess replay feasibility in a shielded laboratory

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing Havoc infrastructure for an authorized exercise
• Reviewing server and traffic relay separation
• Configuring communication profiles for an exercise

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Prepare and publish Xiaohongshu posts, find relevant posts, and send authorized comments or replies using the selected account's browser. Manage drafts and media, verify visible outcomes, and record results in the operations panel.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prepare post drafts and attach image or video assets
• Publish authorized posts from scheduled sessions
• Search for posts and draft relevant comments

Audit a codebase for unnecessary complexity, including dead code, duplicated state, redundant interfaces, and obsolete compatibility paths. Receive evidence-backed simplification candidates, or authorize changes that remove justified targets and validate the behavior that must remain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding code that can be safely removed
• Consolidating duplicated state or APIs
• Reviewing obsolete compatibility paths and design records

Carry out reviewed pull request plans, apply approved fixes, and preserve contributor credit. Validate the exact changes being merged, merge only explicitly authorized groups, and keep items on hold when required checks fail or remain unknown.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Apply approved fixes to reviewed pull requests
• Merge an owner-selected group after required checks pass
• Preserve contributor credit during repairs

Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized penetration test
• Coordinating specialist assessment skills
• Evaluating the impact of linked vulnerabilities

Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized API security assessment
• Reviewing JWT and OAuth 2.0 authentication
• Checking permissions across users and roles

Analyze software protections during authorized reverse engineering, the examination of compiled programs. Helps identify mechanisms that hinder debugging, obscure code, or prevent tampering, then choose safe analysis methods, document findings, and develop defensive recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyze protected software with written permission
• Examine malware within an authorized scope
• Study protection mechanisms in CTFs or approved training

Guide authorized security assessments of REST, SOAP, and GraphQL APIs. Organize endpoint discovery, authentication checks, access control tests, and input testing, then document discovered weaknesses and evidence of unauthorized data access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan API checks for an authorized bug bounty assessment
• Check whether users can access another account's records
• Review GraphQL schema exposure and request limits

Assess authorized Wi-Fi networks through traffic capture, WPA/WPA2 handshake analysis, and rogue access point research. Follow a scoped workflow to evaluate password policies, wireless isolation, and access portals, then report findings and hardening recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing an authorized Wi-Fi network
• Evaluating WPA/WPA2 handshakes and password policies
• Researching rogue access point detection

Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping Active Directory privilege escalation paths
• Reviewing Kerberos authentication weaknesses
• Testing AD CS certificate configuration weaknesses

Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking industrial historian servers for unauthorized clients
• Investigating missing or suspiciously constant process data
• Reviewing signs of movement between IT and OT networks

Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating sudden cloud billing increases
• Responding to GuardDuty cryptocurrency alerts
• Checking containers for unauthorized mining processes

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Authorized testing of access through reused tickets
• Checking detection of Kerberos ticket theft
• Collecting evidence for lateral movement reports

Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized social engineering assessment
• Measuring responses to simulated phishing
• Evaluating phone and physical access checks

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Support authorized Active Directory assessments of DCSync, which abuses directory replication rights to obtain credential data. Cover replication permission review, Golden Ticket persistence testing, detection validation, and documentation of evidence and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing accounts with directory replication rights
• Testing DCSync risks in an authorized lab
• Validating detection of replication abuse and forged tickets

Assess forced authentication and NTLM relay, the forwarding of authentication to another service, in authorized Windows environments. Use Coercer and PetitPotam to document exposed methods and check detection coverage, signing requirements, and Extended Protection for Authentication safeguards.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing exposed forced authentication methods
• Validating NTLM relay risks in authorized environments
• Generating activity to tune security detections