'jwt' 검색 결과

Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing JWT authentication in a web app
• Checking signature and key validation
• Reviewing token storage in mobile apps

Test whether an application accepts forged JWTs, signed tokens that carry identity and role information. The skill covers signature bypasses, algorithm confusion, and untrusted keys, then guides verification of access to another user's data or protected functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing JWT signature verification
• Testing algorithm confusion and key handling
• Checking weak HMAC signing secrets

Test web APIs, authentication, and LLM features with six Python scanners. Check cross-site access rules, header injection, database inputs, and signed login tokens, then investigate hidden server behavior through external callbacks and chatbot responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking CORS and response-header behavior
• Testing NoSQL logins and JWT authentication
• Confirming hidden bugs through external callbacks

Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review password reset links and token handling
• Check reauthentication for email and password changes
• Assess takeover risks involving JWT and SSO

Quarkus 앱의 인증, 접근 권한, 입력 검증을 구현하고 점검합니다. 비밀 정보 관리, 비밀번호 해싱, 요청 제한, 감사 로그와 의존성의 알려진 취약점도 다룹니다.

• Quarkus API에 JWT 또는 OIDC 인증 추가
• 역할별 권한과 데이터 소유자 확인 점검
• 입력 검증과 데이터베이스 조회 검토

Trace how JWT, JWS, and JWE tokens become accepted identities or privileges in a CTF sandbox. Examine headers, key selection, and claims, the token's attributes, then preserve a minimal reproducible path demonstrating validation confusion.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect token headers and key selection in a CTF sandbox
• Trace how token claims become application permissions
• Build a minimal reproduction of token acceptance confusion

Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing order and payment workflow integrity
• Testing concurrent coupon redemption or transfers
• Assessing JWT validation and GraphQL controls

Review API configuration and input handling for unauthorized field updates, prototype pollution that alters shared object defaults, and manipulation of backend URLs. The skill also covers exposed API specifications and access control weaknesses in OData queries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether profile updates accept privileged fields
• Verifying the effects of prototype pollution
• Inspecting backend URL construction

Kotlin과 Ktor로 HTTP 서버를 만드는 구현 예시를 제공합니다. API 라우트, 인증, JSON 변환, 구성 요소 조립, 통신과 테스트를 정리합니다.

• Ktor로 REST API 만들기
• JWT 인증으로 라우트 보호
• Koin으로 앱 구성 요소 정리

Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an authorized API security assessment
• Reviewing JWT and OAuth 2.0 authentication
• Checking permissions across users and roles

Implement application security controls, including login, access permissions, password hashing, and input validation. The skill provides code, configuration requirements, and testing guidance for checking protections against unauthorized access, malicious input, and sensitive data exposure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implementing login with password hashing and rate limits
• Adding JWT validation and session protection
• Preventing SQL injection and malicious script execution

Build Python APIs with FastAPI and Pydantic V2, including input validation, database operations that avoid blocking other work, and token-based authentication. Implement REST or WebSocket endpoints, then check their behavior with automated tests and generated API documentation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build REST APIs with FastAPI
• Validate input data with Pydantic V2
• Implement JWT authentication and authorization

Inspect live development or staging traffic to find an identifier that distinguishes one developer’s requests across services. Produce a matching mirrord HTTP filter and a report showing where the identifier survives, disappears, or cannot be observed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find a filter for personal requests on a shared staging cluster
• Check whether request IDs survive across services
• Build mirrord filters using JWT claims or cookies

Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking legacy login endpoints left outside SSO controls
• Reviewing token trust between partner and admin portals
• Mapping authentication paths across websites and APIs

Plan and implement user login and access permissions using sessions, JWT tokens, or OAuth2. Apply role-based permissions, protect APIs, and review common weaknesses in password handling, cookies, token expiration, and server-side checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implementing user login and logout
• Adding social login or enterprise SSO
• Controlling access by user role

Configure authentication and per-project request limits for Google Cloud API Gateway. Secure access to Cloud Run backends, validate quota changes against existing configurations, and investigate HTTP 429 or Service Control Quota errors, including on MCP-enabled gateways.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Configure API key and JWT authentication
• Restrict direct access to Cloud Run backends
• Validate request quota changes before deployment

Build and debug Java applications with Spring Boot 3.x. This skill guides application design, API implementation, database query tuning, authentication, and testing, including WebFlux applications that process requests without blocking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build APIs with Spring Boot
• Improve slow JPA queries
• Configure OAuth2/JWT authentication

Build .NET 8 APIs and backend services using C# 12, with clear separation of application responsibilities. The skill covers database access, authentication, API documentation, compilation checks, and integration tests that verify components working together.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building endpoints with minimal APIs
• Adding database access with Entity Framework Core
• Separating application responsibilities with MediatR

Build NestJS APIs with TypeScript code for modules, request handlers, services, authentication, input validation, and database access. The skill also prepares Swagger API documentation and unit and end-to-end tests for the implemented features.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building a NestJS REST API
• Adding JWT and Passport authentication
• Connecting TypeORM or Prisma

Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build Django web applications and REST APIs with Django REST Framework. This skill guides data models, input validation, views, authentication, permissions, and tests, while improving how applications retrieve related records from the database.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a REST API with Django
• Design data models and relationships
• Reduce database queries for related records

Assess session management weaknesses, including sessions that survive logout or password changes, fixed session IDs, and refresh-token reuse. The skill uses two real sessions, response-body comparisons, and control checks to distinguish continued account access from misleading successful responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check whether old sessions survive logout
• Verify session invalidation after a password change
• Test refresh-token rotation and reuse detection

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none a...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.