「ids」の検索結果

Detect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze token randomness via Burp Sequencer. Test JSESSIONID, ASP.NET Forms Auth cookies. Tools: OWASP ZAP, Burp Suite Repeater/Sequencer, JHijack.

日本語の概要は準備中です。原文の説明を表示しています。

Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.

日本語の概要は準備中です。原文の説明を表示しています。

Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

日本語の概要は準備中です。原文の説明を表示しています。

Detect and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. Use this skill when testing for unauthorized access to resources by manipulating object identifiers like user IDs, order numbers, file references, or API endpoints. Covers parameter tampering, UUID prediction, hash manipulation, and chained IDOR attacks for maximum impact in bug bounty programs.

日本語の概要は準備中です。原文の説明を表示しています。

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit exposed GraphQL introspection endpoints to map the entire API schema. This skill details how to extract available queries, mutations, types, and fields, which significantly aids in identifying hidden endpoints, Broken Object Level Authorization (BOLA/IDOR), and mass assignment vulnerabilities.

日本語の概要は準備中です。原文の説明を表示しています。

Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.

日本語の概要は準備中です。原文の説明を表示しています。

Pino logging, Sentry error tracking, Axiom - structured logging with correlation IDs, error boundaries, performance monitoring, alerting

日本語の概要は準備中です。原文の説明を表示しています。

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.

日本語の概要は準備中です。原文の説明を表示しています。

Fuse all of a contributor's named skills into a single fusion node (suite capstone) in the registry. Use when the user says "fuse <contributor>'s skills", "create a suite for <contributor>", "build a capstone for <user>", "fuse all of <user>'s named skills", "create a suite fusion", "consolidate <contributor> into one skill", or explicitly types /gaia-fuse-full-suite. Also triggers when a contributor has accumulated 3+ named skills and the user asks what to do next with them, or when someone asks "can we make a suite from these?". This skill: collects component IDs from registry/named/<contributor>/, verifies nodes exist, researches evidence and appraises Trust Magnitude, runs `gaia dev fuse` to write the fusion node and suite manifest, validates, and opens a PR on a review/meta/ branch.

日本語の概要は準備中です。原文の説明を表示しています。

Design or revise Interpreter UI for non-developers with an ultra-minimal, utilitarian style inspired by the OpenAI website and ChatGPT, not the developer platform. Use when simplifying settings, onboarding, chat, forms, empty states, or helper copy; when removing extra containers, labels, or visual noise; when replacing technical wording with plain language; when clarifying hierarchy and making the main user action obvious; when making every visible label and status understandable to an average HR admin or other non-technical user; when hiding implementation details such as logs, IDs, endpoints, paths, or protocol names; or when a screen must respect the app's existing CSS variables and light/dark theme behavior.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

日本語の概要は準備中です。原文の説明を表示しています。

Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from a process memory dump by locating decrypted config structures and decoding common obfuscation layers. Activates for requests to extract malware config from a memory dump, recover C2 settings from a running sample, or decode an in-memory configuration block.

日本語の概要は準備中です。原文の説明を表示しています。

Diagnose and fix slow pyfixest regression GRIDS (many feols/fepois calls run sequentially) that stay slow despite demeaner_backend="cupy64" and an idle GPU. Use when: (1) a script looping dozens of pf.feols models on a 100k+ row panel takes ~1 min/model, (2) process inspection shows ~1-1.5 cores busy and nvidia-smi shows ~0% GPU utilization with a resident cupy context, (3) planning any worker prompt that will run a model grid (robustness variants x FE structures x domains). Root cause: per-model CPU-side single-threaded fixed costs (formulaic model-matrix build, interaction construction, singleton detection, cluster vcov) dominate wall time; GPU demeaning is a small slice. Fix: shard the model grid across OS processes and/or use pyfixest multiple-estimation syntax; mandate this IN THE WORKER PROMPT.

日本語の概要は準備中です。原文の説明を表示しています。

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.

日本語の概要は準備中です。原文の説明を表示しています。

Elite UX/UI & Advanced GSAP Motion Engineer. Enforces Python-driven true randomization for layout variance, strict AIDA page structure, wide editorial typography (bans 6-line wraps), gapless bento grids, strict GSAP ScrollTriggers (pinning, stacking, scrubbing), inline micro-images, and massive section spacing.

日本語の概要は準備中です。原文の説明を表示しています。

Search the built-in assets of the Unity Editor located in the built-in resources: Resources/unity_builtin_extra. Doesn't support GUIDs since built-in assets do not have them.

日本語の概要は準備中です。原文の説明を表示しています。

Use when designing, implementing, or reviewing responsive frontend layouts, mobile-first breakpoints, container queries, fluid grids, data-dense tables, touch targets, safe areas, orientation changes, viewport overflow, or cross-device UI behavior; Chinese triggers include responsive layouts, mobile-side adaptation, breakpoints, container queries, horizontal and vertical screens, touch targets.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of a Coating/Painting/Spraying Machine Operator — calculating wet film thickness from a target dry film thickness and the coating's percent volume solids, deciding whether flash-off time can be shortened to increase throughput, verifying cure by actual part temperature rather than oven setpoint, or tracing an adhesion failure back to surface prep rather than the coating application.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of a Cost Estimator — building a conceptual (Class 5) budget from a napkin sketch, developing a hard-bid estimate from complete construction documents, leveling subcontractor bids before award, making a bid/no-bid call on an RFP, or reconciling a design-development estimate against an owner's target budget.

日本語の概要は準備中です。原文の説明を表示しています。

Query the Ensembl REST API for regulatory feature annotations, variant effect prediction (VEP), coordinate liftover, gene lookups, and cross-references. Use when the user needs to annotate variants with VEP (consequence, CADD, REVEL, SpliceAI), check Ensembl Regulatory Build overlap for ENCODE regions, convert coordinates between GRCh37 and GRCh38, resolve gene IDs (Ensembl ↔ symbol ↔ RefSeq), look up gene phenotype associations, or cross-reference ENCODE targets with Ensembl annotations. Also use when the user mentions Ensembl, VEP, variant effect predictor, liftover, assembly conversion, regulatory build, gene lookup, or cross-references between databases.

日本語の概要は準備中です。原文の説明を表示しています。

Set up SOPS + age encryption for sharing .env files securely across machines. Detects existing state, installs tools, generates age keys, creates .sops.yaml, and encrypts .env files as YAML (avoids SOPS dotenv bug #1435). Use when user mentions "sops setup", "encrypt env", "share secrets", "secure env files", "sops age setup", "env encryption", "setup sops", "share env across machines".

日本語の概要は準備中です。原文の説明を表示しています。