3,460 件 ・ 関連度順
概要と使いどころ
Kubernetes and container security skill for cluster hardening, RBAC review, admission control (OPA Gatekeeper, Kyverno), Pod Security Standards, network policies, secrets management, runtime defense (Falco, Tetragon), image supply chain (cosign, SLSA, in-toto), and CIS benchmark compliance. Use to assess and harden clusters you operate.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract and Web3 security audit skill for Solidity, Vyper, Move, and Cairo. Covers reentrancy, access control, oracle manipulation, MEV/sandwich exposure, signature replay, upgrade safety, ERC token edge cases, bridge risk, and DeFi invariants. Tooling includes Slither, Mythril, Echidna, Foundry, Halmo, Certora, and custom invariant tests. Use for design review, code audit, and incident analysis on contracts you own or are authorized to assess.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.
日本語の概要は準備中です。原文の説明を表示しています。
SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.
日本語の概要は準備中です。原文の説明を表示しています。
Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.
日本語の概要は準備中です。原文の説明を表示しています。
Generate sophisticated initial access payloads designed to bypass email gateways and endpoint antivirus systems while executing Command and Control (C2) agents. Use this skill to craft malicious LNKs, ISOs, Weaponized Office Documents, and HTML Smuggling techniques for Red Team campaigns.
日本語の概要は準備中です。原文の説明を表示しています。
Detects authentication and biometric bypass vulnerabilities in mobile apps (Android/iOS). Trigger on: BiometricPrompt, LocalAuthentication, LAContext, evaluatePolicy, CryptoObject, Android Keystore, Secure Enclave, kSecAccessControlBiometryCurrentSet, userAuthenticationValidityDurationSeconds, confirmCredentials, biometric fallback, PIN bypass, passive authentication, enrolled biometrics detection, Frida hook auth, jailbreak bypass, TouchID, FaceID, fingerprint. Covers MASVS-AUTH-1/2/3.
日本語の概要は準備中です。原文の説明を表示しています。
Use when testing APIs and web frameworks for mass assignment vulnerabilities where user-controlled request body fields are bound directly to model attributes without a field allowlist. Trigger on: ORM update/create endpoints, REST APIs accepting JSON body, Rails strong parameters, Django model forms, Laravel fillable/guarded, Node.js Mongoose/Sequelize, PUT/PATCH requests, registration endpoints, profile update endpoints, GraphQL mutations. Detects privilege escalation via role/admin/isAdmin fields, plan upgrades via subscription fields, and horizontal access via ownerId/userId injection.
日本語の概要は準備中です。原文の説明を表示しています。
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of malicious requests to bypass security controls or poison caches.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting `Content-Length` and `Transfer-Encoding: chunked` headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking, and capturing other users' requests. Detect via timing attacks, differential responses, and tools like Burp's HTTP Request Smuggler extension.
日本語の概要は準備中です。原文の説明を表示しています。
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.
日本語の概要は準備中です。原文の説明を表示しています。
Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.
日本語の概要は準備中です。原文の説明を表示しています。
Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing legitimate user requests.
日本語の概要は準備中です。原文の説明を表示しています。
Detect and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. Use this skill when testing for unauthorized access to resources by manipulating object identifiers like user IDs, order numbers, file references, or API endpoints. Covers parameter tampering, UUID prediction, hash manipulation, and chained IDOR attacks for maximum impact in bug bounty programs.
日本語の概要は準備中です。原文の説明を表示しています。