3,644 件 ・ 関連度順
概要と使いどころ
Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or applying LLL/BKZ reduction to cryptographic constructions.
日本語の概要は準備中です。原文の説明を表示しています。
Use when testing JWT-based authentication for algorithm confusion, alg:none bypass, weak HMAC secrets, missing expiration, kid parameter injection, and token storage in localStorage. Trigger on: Authorization: Bearer tokens, JWTs in cookies, any base64url encoded header.payload.signature pattern, OAuth2 access tokens, API authentication tokens, SSO tokens, JWKS endpoints. Detects RS256→HS256 confusion, public key as HMAC secret, unverified kid values used in file reads or SQL queries, and JWT cracking with short secrets.
日本語の概要は準備中です。原文の説明を表示しています。
Integrate Kaido (Caido) proxy with Claude Code CLI for automated HTTP interception, request replay, and vulnerability scanning. Based on Critical Thinking Ep. 166.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit insecure handling of the HTTP Host header to poison password resets, generate cache poisoning vectors, or bypass internal routing restrictions. Use this skill when web applications dynamically generate URLs, links, or redirects based on the arbitrary Host header value supplied by the client rather than relying on a static, trusted server configuration.
日本語の概要は準備中です。原文の説明を表示しています。
Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.
日本語の概要は準備中です。原文の説明を表示しています。
DOM-based XSS occurs when JavaScript reads attacker-controlled sources (`location.hash`, `document.referrer`, `window.name`, `location.search`) and passes them to dangerous sinks (`document.write`, `innerHTML`, `eval`, `location.href`, `setTimeout`, `jQuery.html()`) without sanitization. Unlike reflected/stored XSS, payloads never reach the server. Detect by auditing JavaScript for tainted data flow from DOM sources to sinks. Tools: Burp Suite DOM Invader, Chrome DevTools, DOMPurify (fix).
日本語の概要は準備中です。原文の説明を表示しています。
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
日本語の概要は準備中です。原文の説明を表示しています。
Implement the 5-stage Funnel workflow (Notes → Leads → Primitives → Findings → Reports) for structured bug bounty hunting. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
Build production-grade Claude Code CLI skills with fallback architecture, TypeScript implementation, and creativity directives. Based on Critical Thinking Bug Bounty Podcast Episode 166 — "Building Claude Skills as a Bug Bounty Hunter."
日本語の概要は準備中です。原文の説明を表示しています。
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
日本語の概要は準備中です。原文の説明を表示しています。
Identify, exploit, and write custom payloads for classic Stack-Based Buffer Overflows in 32-bit and 64-bit applications. Use this skill when conducting exploit development, reverse engineering custom network protocols, or preparing for advanced certifications (OSCP, OSEP). Covers fuzzing, controlling EIP/RIP, identifying bad characters, generating shellcode, finding return/JMP instructions, and gaining reverse shells.
日本語の概要は準備中です。原文の説明を表示しています。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.
日本語の概要は準備中です。原文の説明を表示しています。
Prevent common AI report pitfalls — bug blending, inflated threat models, and generic language. Train Claude with your best past reports for concise, technical submissions. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
Bypass AI safety filters by encoding malicious prompts using ciphers and obfuscation techniques (e.g., Base64, ROT13, Leetspeak, Morse code). This skill exploits the gap where the LLM can decode the request, but intermediate keyword-based safety classifiers cannot.
日本語の概要は準備中です。原文の説明を表示しています。
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
日本語の概要は準備中です。原文の説明を表示しています。
Configure Claude as a "Pair Hunter" — autonomous overnight hacking, context management via per-target .claudemd files, sub-agent compaction avoidance, and scope enforcement. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
Generate interactive, animated, responsive HTML-based terminal simulators to showcase CLI commands, scripts, pipelines, or interactive workflows. Use this whenever you need to visually showcase a command line sequence, mock interactive CLI tools, or simulate code executions.
日本語の概要は準備中です。原文の説明を表示しています。
Work with text embeddings — choosing models, pooling, similarity measures, evaluation, and multilingual considerations. Use when building semantic search, clustering, or any similarity-based feature.
日本語の概要は準備中です。原文の説明を表示しています。
Design role-based agent teams with CrewAI — agents, tasks, crews, and collaboration patterns for complex workflows.
日本語の概要は準備中です。原文の説明を表示しています。
Configure Babel: presets, plugins, env-specific builds, polyfills, and performance. Use when maintaining Babel-based toolchains or writing custom transforms.
日本語の概要は準備中です。原文の説明を表示しています。
Run ABM programs — target account selection, personalized campaigns, sales orchestration, and account-level measurement.
日本語の概要は準備中です。原文の説明を表示しています。
Coordinate teams of role-based agents — role definitions, task delegation, sequential and hierarchical workflows, and shared memory. Use when a job naturally splits into specialist roles collaborating.
日本語の概要は準備中です。原文の説明を表示しています。