26건 · 관련도순
Reference for the DPI desync pipeline (ripdpi-config/-desync/-desync-runtime/-proxy-runtime). Use when changing TcpChainStep/UdpChainStep, offsets, fake-packet/TTL/TLS-prelude behavior, or a candidate's technique. Scheduling: diagnostics-system.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
在授权渗透测试中系统性挖掘 HTTP 请求走私（HTTP Request Smuggling / desync）。当目标前面有反向代理/CDN/负载均衡（前端）转发给后端应用，且怀疑前后端对 Content-Length 与 Transfer-Encoding、畸形头、chunked trailer 的解析不一致时使用——典型场景：想毒化后端 socket 劫持他人请求、批量窃取会话 Cookie/令牌、缓存投毒、绕过前端访问控制。适用目标类型 Web / REST API（有分层代理）。触发场景包括用户说"测下有没有 HTTP 走私/desync""这个 CDN 后端解析一致吗""能不能毒 socket 偷别人 cookie""CL.TE / TE.CL 打一下"。输出：带 desync 时序证据与原始报文的 finding 报告（含 killed 记录）。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Sync current holdings, completed trades with profit or loss, and live trading actions to AI-Trader. Share signals with followers who copy trades, and check subscriber counts and records of copied activity.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert multiplayer for desync, rollback, dedicated --headless servers, interest culling, and bandwidth spikes: ENet/WebRTC choice, authority, secure RPCs, client prediction/reconcile, and adaptive sync. Trigger on rubber-banding, cheat-able clients, peer floods, late join, or profiler Network spikes — not only greenfield online games. Keywords: multiplayer, RPC, ENetMultiplayerPeer, MultiplayerSynchronizer, authority, client prediction, rollback, interest management, headless, desync.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert multiplayer for desync, rollback, dedicated --headless servers, interest culling, and bandwidth spikes: ENet/WebRTC choice, authority, secure RPCs, client prediction/reconcile, and adaptive sync. Trigger on rubber-banding, cheat-able clients, peer floods, late join, or profiler Network spikes — not only greenfield online games. Keywords: multiplayer, RPC, ENetMultiplayerPeer, MultiplayerSynchronizer, authority, client prediction, rollback, interest management, headless, desync.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provides a reference for reviewing DeFi smart contracts, programs that manage blockchain transactions. It organizes vulnerability types with causes, code examples, search patterns, and fixes to help investigate accounting, permissions, boundary conditions, and pricing logic.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Design and harden Roblox client/server networking with RemoteEvent, RemoteFunction, and UnreliableRemoteEvent; server authority, argument and Instance validation, rate limits, proximity/ownership checks, targeted replication, streaming, lifecycle, prediction, and reconciliation. Use for Roblox remotes, exploits, request spam, multiplayer replication, network ownership, high-frequency cosmetic updates, or server/client desynchronization.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a Godot 4 game goes online or co-op: host and join with ENet, WebSocket for a web build, RPCs (@rpc, rpc_id, any_peer), MultiplayerSpawner and MultiplayerSynchronizer, player authority, lobbies and login, a dedicated or headless server export, lag, rubber-banding, prediction or netfox, cheating, bandwidth, Steam, Nakama or WebRTC. Symptoms: players do not appear on the client, 'rpc node checksum failed', 'node not found' on an RPC, desync, the server build is huge, a client never connects.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
HTTP request smuggling / desync hunting - CL.TE, TE.CL, TE.TE, CL.0, and HTTP/2 downgrade. Timing-based detection, differential confirmation, no-blind-claims. Wiki-first, FIND schema output.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Fix content serving failures caused by metadata (KV store, database) being out of sync with actual storage (GCS, S3, filesystem). Use when: (1) Content exists in storage but API returns "processing" or "not ready", (2) Webhook callbacks that update metadata failed silently, (3) Backfill scripts generated content but didn't update status records, (4) HLS/transcoded content exists but transcode_status is not "Complete", (5) Handler checks metadata status BEFORE checking if content actually exists in storage.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reference for the diagnostics pipeline (ripdpi-monitor-engine/ripdpi-diagnostics-* and core/diagnostics). Use when changing ScanRequest/ScanReport, ProbeTask families, probe scheduling, the catalog, or the wire contract. Techniques: desync-engine.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
HTTP/Web exploitation until a server shell or equivalent OS execution. Use after /web-recon has mapped the application. Covers injection, upload, LFI, SSRF/XXE, SSTI, deserialization, JWT/SAML, API logic, desync/cache/parser, and Web-controlled backend abuse. WAF stays here. Endpoint blocks after OS execution hand off to /edr-bypass then return. Direct non-HTTP service ports belong to /recon or /service-attack.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Hunt HTTP Request Smuggling (CL.TE, TE.CL, TE.TE, H2.CL, H2.TE, downgrade smuggling). Use when target is behind a reverse proxy / load balancer / CDN and you want to test for desync attacks that bypass front-end security controls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Recover from stale RFDB nodes that survive `commit_batch` cleanup despite having their `file` field listed in `changed_files`. Use when: (1) re-running an enricher/orchestrator step but old data with the same file field stays in the graph, (2) `commit_batch(changed_files=[X], ...)` reports success but a query later still returns nodes with `file = X`, (3) you re-pointed structural nodes (e.g., DIRECTORY/FILE) from a synthetic file path to real file paths and the old synthetic-path nodes won't go away, (4) graph-stream / find_by_type returns a mix of "stale" and "new" nodes for the same logical entity. Root cause: `handle_commit_batch` calls `engine.find_by_attr({file: X})` to enumerate nodes-to-delete, but that query path returns only a PARTIAL set after compaction (L1 segments and the file→nodes index can desync). Workaround: enumerate stale nodes via the TS rfdb client `queryNodes({file: X})` (different code path that finds all of them) and call `deleteNode(id)` per node, then re-commit the intended state. Related: rfdb-manifest-l1-carryforward (same L1 family).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of malicious requests to bypass security controls or poison caches.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audits env var config: file inventory, code-to-example sync, default desync, naming, startup validation. Stack-adaptive.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Diagnose, fix, or validate SwiftUI animation and scroll behavior by temporarily instrumenting views with MotionEyes, capturing console traces over time, and comparing motion data to user intent or test expectations. Use when users report bugs such as wrong direction, premature fade, timing or easing mismatch, unexpected movement, missing movement, incorrect relative movement between views, scroll jumps, scroll restoration drift, content-offset desynchronization, or when they want to turn MotionEyes traces into focused assertions. Prefer XcodeBuildMCP log capture first and fallback to CLI log streaming; remove only agent-added MotionEyes instrumentation after validation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
HTTP Request Smuggling — frontend/backend HTTP parser uyumsuzluğunu sömürerek auth bypass, cache poisoning, internal endpoint erişimi
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.