7,617 件 ・ 関連度順
概要と使いどころ
Re-read pinned on-chain facts and watch documentary source fingerprints behind failure scenarios monthly, reporting drift without approving or changing scenario records automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Drain the Pharos Dependency Map coverage-audit queues into evidence-refreshed edges, reviewed target dispositions, or documented deferrals. Use monthly after weekly production dependency audits, after dependency coverage drops, or when reviewing adapter gaps, material unlinked slices, symbol leads, duplicate/split groups, or unverifiable published edges.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy an Evil Twin (Rogue Access Point) to clone a legitimate Wi-Fi network's SSID and MAC address. By combining this with targeted deauthentication attacks, an attacker aggressively forces nearby victims to silently connect to the malicious AP, enabling pervasive Man-in-the-Middle (MitM), captive portal phishing, and credentials interception.
日本語の概要は準備中です。原文の説明を表示しています。
Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.
日本語の概要は準備中です。原文の説明を表示しています。
Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.
日本語の概要は準備中です。原文の説明を表示しています。
Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.
日本語の概要は準備中です。原文の説明を表示しています。
Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary absent, RELRO, ARC disabled, third-party library CVE, vulnerable dependency, outdated SDK, targetSdkVersion, update enforcement missing, implicit Intent, URL loading in WebView, object persistence, memory corruption, OWASP dependency check. Covers MASVS-CODE-1/2/3/4.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Exploit path traversal and local/remote file inclusion (LFI/RFI) via URL parameters, cookies, and hidden fields using ../ sequences, URL encoding (%2e%2e%2f), double encoding (%252e%252e%255c), Unicode bypasses (..%c0%af), and Windows UNC paths. PHP include/require with $_GET/$_POST/$_COOKIE pattern. Target /etc/passwd, boot.ini, web.config. Tools: DotDotPwn, WFuzz, Burp Suite, ZAP.
日本語の概要は準備中です。原文の説明を表示しています。
NTLM relay and authentication coercion playbook. Use when capturing and relaying NTLM authentication to escalate privileges via SMB, LDAP, HTTP, or MSSQL relay targets, combined with PetitPotam, PrinterBug, and other coercion methods.
日本語の概要は準備中です。原文の説明を表示しています。
macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
日本語の概要は準備中です。原文の説明を表示しています。
Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
日本語の概要は準備中です。原文の説明を表示しています。
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Use when testing file upload endpoints for unrestricted file upload, MIME type bypass, magic byte spoofing, polyglot files, SVG XSS, XXE via Office documents, ZIP slip, and path traversal in filenames. Trigger on: multipart/form-data endpoints, avatar/document upload flows, import-from-file features, profile image, CSV/Excel import, DOCX/XLSX parsing, image resizing pipelines, archive extraction, and any endpoint that stores or serves user-supplied files. Detects extension bypass (shell.php.jpg), null byte injection, double extension, ImageMagick exploits, and content-type confusion.
日本語の概要は準備中です。原文の説明を表示しています。
Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Linux Capabilities. This skill covers how attackers escalate privileges to root without relying on SUID binaries or kernel exploits by abusing excessive capabilities like cap_dac_read_search, cap_sys_ptrace, or cap_setuid assigned to ordinary files.
日本語の概要は準備中です。原文の説明を表示しています。
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
日本語の概要は準備中です。原文の説明を表示しています。
Execute sophisticated Data Extraction and Privacy Leakage attacks explicitly against Large Language Models (LLMs) to natively force the neural network entirely into organically regurgitating exact, verbatim strings of Highly Confidential Personally Identifiable Information (PII), proprietary source code, or copyrighted material categorically memorized intrinsically during its foundational pre-training phase.
日本語の概要は準備中です。原文の説明を表示しています。
Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting forged requests to a target application by exploiting browser automatic cookie attachment. Detect via missing or predictable CSRF tokens in state-changing requests (POST/PUT/DELETE), absent `SameSite` cookie attributes, and JSON endpoints accepting `text/plain` Content-Type. Test using HTML auto-submitting forms, XHR requests, and CORS-enabled fetch. Tools: Burp Suite (Generate CSRF PoC), OWASP ZAP.
日本語の概要は準備中です。原文の説明を表示しています。
Use when auditing GitHub Actions workflows for script injection vulnerabilities via unsanitized context expressions. Trigger on: "github actions injection", "workflow injection", "head_ref injection", "github context injection", "pwn request", "github.head_ref", "github.event.pull_request.title", "github.event.issue.body", pull_request_target workflows, run: steps interpolating GitHub context variables, CI/CD script injection, GitHub Actions security audit.
日本語の概要は準備中です。原文の説明を表示しています。
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.
日本語の概要は準備中です。原文の説明を表示しています。