59건 · 관련도순
Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
在授权渗透测试中挖掘不安全反序列化（insecure deserialization）。当目标把用户可控数据交给 unserialize/Marshal/pickle/ObjectInputStream/BinaryFormatter/YAML.load 等还原成对象时使用——典型场景：cookie/token/viewstate/隐藏字段里出现序列化数据、导入文件触发对象还原、想借 gadget chain 拿 RCE。适用目标类型 Web / REST API（PHP/Ruby/Python/Java/.NET）。触发场景包括用户说"测下反序列化""这个 cookie 是不是序列化对象""能不能 gadget chain 打 RCE""phar/Marshal/pickle 打一下"。输出：识别出的序列化落点 + gadget 可用性判定 + 带外/回显证据的 finding（含 killed 记录）。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
在授权渗透测试中挖掘 JavaScript 原型污染（prototype pollution，服务端 Node.js 与客户端）。当目标把用户可控的键名递归合并进对象（merge/extend/set/clone、JSON body、query 解析）时使用——典型场景：用 `__proto__`/`constructor.prototype` 注入属性，污染全局原型，进而 DoS、改逻辑、配合 gadget 提权到 XSS/RCE。适用目标类型 Web / REST API（Node.js） / 前端。触发场景包括用户说"测下原型污染""这个 merge 能不能 __proto__""污染原型打 RCE/XSS""lodash/jquery 有没有污染点"。输出：污染点 + 可用 gadget 判定 + 反射证据的 finding（含 killed 记录）。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
JavaScript prototype pollution — Object.prototype'u kirleterek auth bypass, RCE, XSS gadget chains (server-side Node.js ve client-side)
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Measure ACSets better than authors via surjectivity gadgets, Betti numbers, Möbius classification, and p-adic ultrametric distance
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Diagnoses and fixes CI failures and re-runs GitHub Actions jobs. Use when CI is failing, tests break in CI, lint errors block merging, a build fails, or jobs need re-running.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Stack buffer overflow + ROP chain ile kontrol akışı ele geçirme — NX etkin, canary yok senaryoları için eksiksiz tarif
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Sigreturn Oriented Programming (SROP) — sigreturn syscall ile tüm registerları tek payload'da kontrol etme; gadget kıtlığında ROP alternatifi
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Diagnoses and fixes CI failures and re-runs GitHub Actions jobs. Use when CI is failing, tests break in CI, lint errors block merging, a build fails, or jobs need re-running.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review a task implementation against approved specs, task boundaries, and verification evidence. Use after an implementer finishes a task, after remediation, or before accepting a task as complete.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.