「credentials」の検索結果

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS to access the highly sensitive Instance Metadata Service (IMDS). This allows an attacker to steal valid IAM roles and temporary security credentials, leading to catastrophic cloud account compromise.

日本語の概要は準備中です。原文の説明を表示しています。

Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing.

日本語の概要は準備中です。原文の説明を表示しています。

Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).

日本語の概要は準備中です。原文の説明を表示しています。

Deploy an Evil Twin (Rogue Access Point) to clone a legitimate Wi-Fi network's SSID and MAC address. By combining this with targeted deauthentication attacks, an attacker aggressively forces nearby victims to silently connect to the malicious AP, enabling pervasive Man-in-the-Middle (MitM), captive portal phishing, and credentials interception.

日本語の概要は準備中です。原文の説明を表示しています。

Detects authentication and biometric bypass vulnerabilities in mobile apps (Android/iOS). Trigger on: BiometricPrompt, LocalAuthentication, LAContext, evaluatePolicy, CryptoObject, Android Keystore, Secure Enclave, kSecAccessControlBiometryCurrentSet, userAuthenticationValidityDurationSeconds, confirmCredentials, biometric fallback, PIN bypass, passive authentication, enrolled biometrics detection, Frida hook auth, jailbreak bypass, TouchID, FaceID, fingerprint. Covers MASVS-AUTH-1/2/3.

日本語の概要は準備中です。原文の説明を表示しています。

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

日本語の概要は準備中です。原文の説明を表示しています。

Execute an IPv6 DNS Spoofing attack using `mitm6` on an IPv4-only corporate network. Exploit default Windows behavior (preferring IPv6 DHCP/DNS) to intercept NTLMv2 hashes, force WPAD rogue proxy settings, and relay credentials to Active Directory services.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities to extract AWS IAM credentials from the Instance Metadata Service version 2 (IMDSv2). This skill details how to bypass the token requirement of IMDSv2 by chaining HTTP verbs (PUT then GET) if the SSRF vulnerability allows full control over the request headers and methods.

日本語の概要は準備中です。原文の説明を表示しています。

Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Operate a logged-in Miaoshou ERP workflow for TikTok Shop Malaysia product discovery, product screening, profit estimation, listing preparation, and reviewed publishing. Use when the user asks to search or select products in 妙手 ERP, evaluate low-price traffic products, prepare Malaysian TikTok Shop listings, move products into the TikTok collection box, or publish approved listings. Prefer browser operation through the user's existing login; never store credentials or call undocumented private endpoints.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input

日本語の概要は準備中です。原文の説明を表示しています。

Use for AI image, video, audio, or 3D generation/editing. Prefer configured media tools when present, estimate cost before running a paid model, and keep provider credentials in the user's environment or provider configuration.

日本語の概要は準備中です。原文の説明を表示しています。

Chanjing AI creation Open API client: submit image/video tasks, poll task status, list and get tasks, and optionally download outputs when the user runs download_result.py. Reads and writes local credentials.json; calls open-api.chanjing.cc.

日本語の概要は準備中です。原文の説明を表示しています。

Master orchestrator for B2B SaaS content creation and the editorial production system behind it. Use this skill to produce blog articles, whitepapers, case studies, video scripts, newsletters and ghostwritten thought leadership, to develop content strategy, and to run the publishing line itself — content briefs, editorial calendars and production capacity, review and approval workflow, subject-matter-expert access, the style guide, an AI-drafting policy, and a content inventory with owners. Also triggers on: blog, article, case study, whitepaper, newsletter, video script, ghostwriting, content calendar, editorial, thought leadership, content strategy, content brief, content operations, content ops, editorial workflow, managing editor, who reviews this, our content pipeline is stuck, content is stuck in review, content audit, content inventory, content governance, style guide, house style, SME interview, expert interview, freelance writers, AI content policy, how much content can we actually produce. Also owns the customer academy and customer education: online courses, onboarding curriculum, tutorials, certification programs, digital credentials and badges, exam and pass-mark design, course freshness when the product UI changes, and whether the academy should sit behind a login. Triggers on: customer academy, customer education, online course, course library, learning path, curriculum, tutorial, certification program, certified users, digital badge, Open Badges, recertification, exam, pass mark, LMS, Skilljar, our tutorial shows the old UI, our course is out of date, should the academy be gated, do certified customers renew better.

日本語の概要は準備中です。原文の説明を表示しています。

Generate accurate Volcengine SDK examples by locating an API through API Explorer search, fetching its swagger, and calling api/common/explorer/make-code with user-provided Params. Use when the user asks how to write Volcengine SDK code, generate SDK samples, or call a Volcengine API in Python, Go, Java, PHP, cURL, Node.js. Supports Chinese and English API names such as "角色扮演", "AssumeRole", or "STS AssumeRole". Also use for explicit SDK configuration questions about retry, timeout, AK/SK, STS, AssumeRole, temporary credentials, proxy, connection pooling, SSL, debug mode, request signing, response parsing, and error handling. If the user only needs API parameters, enum values, required fields, error codes, response schemas, pagination, or API comparisons, hand off to volcengine-api. If they need CLI-based operations, hand off to volcengine-cli.

日本語の概要は準備中です。原文の説明を表示しています。

Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.

日本語の概要は準備中です。原文の説明を表示しています。

Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.

日本語の概要は準備中です。原文の説明を表示しています。

Audit codebases for leaked secrets and hardcoded credentials, generate .env templates, configure secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, set up credential rotation, and integrate secrets into CI/CD pipelines via OIDC federation

日本語の概要は準備中です。原文の説明を表示しています。

Guides developers through Google Ads API quickstart: credential setup, choosing from 6 client libraries/REST, configuring environments, and running a "retrieve campaigns" script. Troubleshoots common setup errors: USER_PERMISSION_DENIED, login_customer_id issues, and DEVELOPER_TOKEN_NOT_APPROVED. Use this skill when: - The user asks how to get started with the Google Ads API. - The user needs to set up Google Ads credentials or developer tokens. - The user wants to write a quickstart/example script for Google Ads. - The user encounters errors like USER_PERMISSION_DENIED or DEVELOPER_TOKEN_NOT_APPROVED.

日本語の概要は準備中です。原文の説明を表示しています。