6,738 件 ・ 人気順
概要と使いどころ
Operate Cobalt Strike for red team engagements including Beacon deployment, C2 communication, post-exploitation, lateral movement, and evasion. Use this skill when conducting authorized red team operations that require a commercial C2 framework. Covers malleable C2 profiles, staged/stageless payloads, sleep and jitter configuration, SOCKS proxying, and advanced BOF (Beacon Object Files) usage for opsec-safe operations.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Illicit Consent Grants in Azure Active Directory (Entra ID). This skill covers crafting a malicious OAuth application to trick victims into granting broad permissions (like reading emails, modifying files) without requiring their password or MFA.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.
日本語の概要は準備中です。原文の説明を表示しています。
Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.
日本語の概要は準備中です。原文の説明を表示しています。
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Identity and Access Management (IAM) permissions within Amazon Web Services (AWS) to escalate privileges. Use this skill to move from a low-privileged compromised IAM user/role (e.g., via SSRF) to full AdministratorAccess by abusing AssumeRole, PassRole, inline policies, or resource attachments.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Server-Side Request Forgery (SSRF) vulnerabilities to extract AWS IAM credentials from the Instance Metadata Service version 2 (IMDSv2). This skill details how to bypass the token requirement of IMDSv2 by chaining HTTP verbs (PUT then GET) if the SSRF vulnerability allows full control over the request headers and methods.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Server-Side Request Forgery (SSRF) vulnerabilities on Amazon Web Services (AWS) EC2 instances to access the highly sensitive Instance Metadata Service (IMDS). Circumvent basic protections and extract temporary IAM access keys, escalating privileges comprehensively across the AWS Cloud environment.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigurations in AWS Cognito, specifically focusing on unauthorized identity pool access, user pool self-registration issues, and privilege escalation via custom attributes to access broader AWS infrastructure.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
日本語の概要は準備中です。原文の説明を表示しています。
Toggle the badges-page Honesty Mode build-time flag on or off. ON makes the README badge generator emit direct /badges/_assets/<handle>/<file>.svg URLs (no Cloudflare Worker, no ?repo= validation). OFF restores worker-validated URLs. Use when the user says "/honesty-mode on", "/honesty-mode off", "turn honesty mode on/off", or asks for the current honesty-mode state.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill whenever the user wants to see how their branch will look on the live Gaia website before merging — "preview this branch", "show me what this looks like", "deploy a preview", "trigger a design preview", "can I see the site with these changes", "preview the skill profile", "check how this renders on the site", "spin up a preview deployment". This skill dispatches a Cloudflare Worker preview deployment for the current branch via GitHub Actions — no local build tooling required. Ideal for containerized environments, design reviews, and confirming that newly curated skills or profile pages render correctly before a PR is merged to main. The preview does NOT regenerate docs; it deploys `docs/` from the branch as-is. If your change depends on regenerated Class S artifacts, run `gaia dev docs` and commit those first — the preview then reflects them.
日本語の概要は準備中です。原文の説明を表示しています。
FastAPI guidance — typed endpoints, Pydantic validation, dependency injection, async patterns, and production deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Google Cloud guidance — core services, IAM, VPC networking, GKE/Cloud Run choices, BigQuery, and cost control.
日本語の概要は準備中です。原文の説明を表示しています。
Setting up application error tracking — SDK integration, grouping, and context — works with any error-monitoring platform.
日本語の概要は準備中です。原文の説明を表示しています。
Docker guidance — Dockerfile best practices, multi-stage builds, Compose, networking, volumes, and image security.
日本語の概要は準備中です。原文の説明を表示しています。
Affordable serverless GPU inference on DeepInfra — broad open-model catalog with straightforward pricing.
日本語の概要は準備中です。原文の説明を表示しています。
Deno runtime guidance — TypeScript-first development, permissions, standard library, and deploying Deno apps.
日本語の概要は準備中です。原文の説明を表示しています。
Design data loss prevention — data discovery, classification, policy enforcement across endpoint, network, and cloud.
日本語の概要は準備中です。原文の説明を表示しています。
Django guidance — project structure, ORM mastery, admin, auth, async views, and production deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Reusable deployment templates — one-click deploys, blueprints, and environment-as-code — vendor-neutral patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy and operate endpoint detection and response — policy tuning, behavioral detections, threat hunting, and response actions.
日本語の概要は準備中です。原文の説明を表示しています。
Monitoring scheduled jobs — heartbeat checks, missed runs, and duration anomalies — platform-agnostic patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Scheduled jobs on PaaS and in the cloud — cron syntax, reliability, and observability — vendor-neutral patterns.
日本語の概要は準備中です。原文の説明を表示しています。