699 件 ・ 関連度順
概要と使いどころ
Extract endpoints, secrets, and hidden routes from JavaScript files using LinkFinder, SecretFinder, JSluice, and source-map analysis. Use when the user has live hosts and needs to mine the JS for attack surface that's not visible in the UI.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt file upload vulnerabilities — bypass content-type/extension/magic-byte/size filters, achieve XSS via SVG/HTML upload, achieve RCE via .phtml/.jsp/.htaccess, exploit path traversal in filenames, and use polyglot files. Use when an endpoint accepts file uploads.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt Server-Side Request Forgery (SSRF) — internal network access, cloud metadata exploitation, gopher/file/dict protocol abuse, and 11 IP-filter bypass techniques. Use when an endpoint accepts a URL, hostname, or file path as input.
日本語の概要は準備中です。原文の説明を表示しています。
Identify exact technology stack, frameworks, versions, and CMS on live hosts. Use when the user has a live host list and needs to know what's running before choosing vuln classes to test.
日本語の概要は準備中です。原文の説明を表示しています。
Enumerate subdomains using passive and active techniques (subfinder, amass, chaos, assetfinder, crtsh, DNS brute force). Use when the user has a root domain in scope and needs the full subdomain list before probing.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt Server-Side Template Injection (SSTI) in Jinja2, Twig, Freemarker, Velocity, Smarty, ERB, Handlebars, Mustache, and Spring (SpEL). Use when input is reflected in a way that suggests template rendering — error pages, email templates, PDF generators, dynamic content systems.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt SQL injection in REST/GraphQL/SOAP/raw parameters using sqlmap, ghauri, manual UNION/Time/Boolean techniques, and custom WAF-bypass tamper scripts. Use when an input flows into a database query or when the user has identified a parameter that might be vulnerable.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt full Account Takeover (ATO) by chaining lower-severity findings — IDOR-to-email-disclosure, password-reset-token-theft, OAuth-redirect-uri abuse, response-manipulation, cookie scope, CRLF in Set-Cookie, race-condition on signup. Use when the user wants to escalate small findings to ATO or thinks an ATO path exists.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt authentication and authorization bypasses — forced browsing, path traversal in auth, header injection, JWT downgrade, OAuth state confusion, role manipulation. Use when an endpoint returns 401/403 but appears reachable.
日本語の概要は準備中です。原文の説明を表示しています。
Parse HackerOne / Bugcrowd / Intigriti scope into a structured asset list with in-scope, out-of-scope, and excluded-vuln-class breakdowns. Use when the user has chosen a program and needs to understand exactly what's allowed before recon.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt cloud misconfigurations exposed externally — open S3/GCS buckets, exposed IAM-tied EC2 metadata, Cognito misconfig, GitHub Actions secret leakage, exposed Kubernetes API, public Elastic / Kibana / Mongo, Firebase RTDB rules, weak AWS access keys discovered in JS/mobile. Use when leveraging leaked credentials or hunting cloud surface in scope.
日本語の概要は準備中です。原文の説明を表示しています。
Probe subdomain list with httpx/dnsx/naabu to identify live hosts, open ports, status codes, titles, and basic fingerprints. Use after subdomain-enum produces a sub list. Output feeds into fingerprinting and content discovery.
日本語の概要は準備中です。原文の説明を表示しています。
Validate a bug bounty finding before writing a report — the 7-Question Gate, 4 pre-submission gates, always-rejected list, conditional chain table, CVSS 3.1 quick reference, and severity decision guide. Use BEFORE writing any report to avoid N/A and low quality submissions.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt reflected, stored, and DOM-based Cross-Site Scripting (XSS) including CSP bypass, polyglot payloads, mutation XSS (mXSS), markdown XSS, and template XSS. Use when the user has identified a parameter or input that reflects to the page, or wants to test for XSS in a specific input.
日本語の概要は準備中です。原文の説明を表示しています。
Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt JSON Web Token (JWT) vulnerabilities — alg=none bypass, RS256→HS256 key confusion, weak HMAC secret cracking, kid path traversal, JWKS injection, jku/x5u header attacks, embedded JWK confusion, expired-token acceptance, claim mutability, and token replay. Use when an app uses JWT for authentication or stateless sessions.
日本語の概要は準備中です。原文の説明を表示しています。
Write production-grade HackerOne reports — title formula, impact-led writing, CVSS 3.1 scoring, complete PoC formatting, attached files, and submission etiquette. Use AFTER triage-validation passes and you're ready to submit on HackerOne.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluate HackerOne / Bugcrowd / Intigriti programs before committing time. Decide signal-to-noise, payout history, response time, scope size, and competition level. Use when the user is considering a new bug bounty target or asking "should I hunt this".
日本語の概要は準備中です。原文の説明を表示しています。
Write Bugcrowd-format reports — VRT (Vulnerability Rating Taxonomy) mapping, P1-P5 severity, impact-led writing, and Bugcrowd-specific submission etiquette. Use AFTER triage-validation passes for Bugcrowd programs.
日本語の概要は準備中です。原文の説明を表示しています。
Agent eXperience Interface (AXI) router — the main entry point for agent-ergonomic CLIs. Use whenever the agent needs GitHub, browser automation, human review, quota routing, Slack, Notion, AWS/Docker/K8s, databases, GitLab (glab-axi), Oracle DB (oracle-axi), tmux/herdr/WezTerm sessions (cyber-mux), or any AXI-catalog tool; when choosing AXI vs MCP vs raw CLI; when building or reviewing an agent-facing CLI; or when the user says axi, gh-axi, chrome-devtools-axi, TOON output, agent ergonomics, or "prefer AXI". When in doubt about which external tool interface to use, start here.
日本語の概要は準備中です。原文の説明を表示しています。
Perform an advanced offensive security audit and attack simulation on the current features.
日本語の概要は準備中です。原文の説明を表示しています。
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Security Operations Center skill for alert triage, detection engineering, incident response, log analysis, threat hunting, SIEM queries, EDR investigation, timeline building, IOC handling, escalation notes, containment recommendations, and analyst-ready reporting. Use for blue-team operations, suspicious event analysis, and defensive cybersecurity workflows.
日本語の概要は準備中です。原文の説明を表示しています。