본문으로 건너뛰기
cccskills
무료GitHub에 공개

server-side

Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools스타 595(GitHub 595 + cccskills 0)

실행 점수 미검증

설치 방법 보기

포함된 파일(50)

  • SKILL.md1.9 KB
  • reference/file-upload-resources.md5.3 KB
  • reference/http-host-header-resources.md4.9 KB
  • reference/http-request-smuggling-resources.md4.8 KB
  • reference/INDEX.md6.2 KB
  • reference/insecure-deserialization-resources.md7.1 KB
  • reference/protocol-coercion.md4.5 KB
  • reference/scenarios/deserialization/dotnet-deserialization.md11.1 KB
  • reference/scenarios/deserialization/java-deserialization.md7.2 KB
  • reference/scenarios/deserialization/nodejs-deserialization.md5.7 KB
  • reference/scenarios/deserialization/php-deserialization.md6.1 KB
  • reference/scenarios/deserialization/python-and-ruby.md5.7 KB
  • reference/scenarios/deserialization/react-server-components-flight.md6.6 KB
  • reference/scenarios/deserialization/tools/aspnet_viewstate_build.py3.4 KB
  • reference/scenarios/file-upload/content-type-and-magic-bytes.md3.4 KB
  • reference/scenarios/file-upload/defense-evasion-and-yara.md5.1 KB
  • reference/scenarios/file-upload/extension-bypass.md3.6 KB
  • reference/scenarios/file-upload/ntfs-junction-write-redirect.md6.4 KB
  • reference/scenarios/file-upload/ntlm-hash-leak-via-media-upload.md5.3 KB
  • reference/scenarios/file-upload/path-traversal-and-htaccess.md7.6 KB
  • reference/scenarios/file-upload/polyglot-and-metadata-injection.md7.2 KB
  • reference/scenarios/file-upload/python-module-shadowing-via-so.md7.2 KB
  • reference/scenarios/file-upload/race-conditions.md5.2 KB
  • reference/scenarios/file-upload/web-shell-payloads.md6.3 KB
  • reference/scenarios/host-header/auth-bypass-localhost.md3.3 KB
  • reference/scenarios/host-header/cache-poisoning-via-host.md3.0 KB
  • reference/scenarios/host-header/password-reset-poisoning.md2.8 KB
  • reference/scenarios/host-header/routing-ssrf-and-flawed-parsing.md4.6 KB
  • reference/scenarios/http-smuggling/cl-te.md4.9 KB
  • reference/scenarios/http-smuggling/cl-zero-and-pause-based.md2.4 KB
  • reference/scenarios/http-smuggling/exploitation-patterns.md3.8 KB
  • reference/scenarios/http-smuggling/h2-downgrade.md3.5 KB
  • reference/scenarios/http-smuggling/te-cl.md1.9 KB
  • reference/scenarios/http-smuggling/te-te-obfuscation.md2.3 KB
  • reference/scenarios/path-traversal/basic-payloads-and-encoding.md4.5 KB
  • reference/scenarios/path-traversal/filter-bypass-techniques.md9.1 KB
  • reference/scenarios/path-traversal/lfi-to-rce.md10.3 KB
  • reference/scenarios/path-traversal/nbconvert-jupyter-notebook.md7.2 KB
  • reference/scenarios/path-traversal/platform-specific.md7.0 KB
  • reference/scenarios/path-traversal/target-files.md7.4 KB
  • reference/scenarios/ssrf/blind-detection-and-portscan.md4.3 KB
  • reference/scenarios/ssrf/cloud-metadata.md5.5 KB
  • reference/scenarios/ssrf/localhost-and-ip-bypass.md5.9 KB
  • reference/scenarios/ssrf/protocol-exploitation-gopher.md6.1 KB
  • reference/scenarios/ssrf/proxy-path-traversal.md2.9 KB
  • reference/scenarios/ssrf/redis-inline-via-header-name.md7.0 KB
  • reference/scenarios/ssrf/stored-connector-url-ssrf.md7.5 KB
  • reference/scenarios/ssrf/url-parser-and-allowlist-bypass.md3.1 KB
  • reference/scenarios/ssrf/utf8-binary-loss-limit.md8.0 KB
  • reference/server-side-principles.md6.6 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

Techniques

TypeKey Vectors
SSRFInternal service access, cloud metadata, protocol smuggling
HTTP SmugglingCL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync
Path TraversalDirectory traversal, null bytes, encoding bypass
File UploadExtension bypass, content-type manipulation, polyglot files
DeserializationJava, PHP, Python, .NET gadget chains
Host HeaderPassword reset poisoning, cache poisoning, routing-based SSRF
CUPS / cups-browsedCVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md)

Workflow

  1. Identify server-side processing points
  2. Test for vulnerability class indicators
  3. Bypass protections (WAF, allowlists, encoding filters)
  4. Demonstrate impact (file read, RCE, internal access)
  5. Capture evidence with PoC

Reference

  • reference/scenarios/ssrf/*.md - SSRF techniques and labs
  • reference/http-request-smuggling*.md - Smuggling techniques
  • reference/scenarios/path-traversal/*.md - Path traversal bypass methods
  • reference/file-upload*.md - File upload exploitation
  • reference/insecure-deserialization*.md - Deserialization attacks
  • reference/http-host-header*.md - Host header injection
  • skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

ai-threat-testing

무료

Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

api-security

무료

API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

attack-path-stitcher

무료

Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

authenticated-session-acquisition

무료

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

authentication

무료

Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

blockchain-security

무료

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

transilienceai/communitytools5952026년 7월 30일 업데이트

transilienceai의 스킬 모두 보기

이 스킬의 문제 신고