6,407 件 ・ 関連度順
Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.
日本語の概要は準備中です。原文の説明を表示しています。
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering 'stopping' on a defended target. The single most important skill to load when scope is 'external red team' not 'bug bounty / WAPT'.
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester pivot through compromised hosts to reach
日本語の概要は準備中です。原文の説明を表示しています。
Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Dependency confusion / supply chain (internal package-name discovery, unclaimed-name confirmation, callback-only PoC, npm/pip/Maven/RubyGems variants). Use when hunting a specific vuln class or studying what makes bugs pay.
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester perform network reconnaissance and service
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester bypass AV/EDR that is blocking payload
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication a...
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester enumerate an XMPP/Jabber service. This
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester enumerate database services and check for
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester enumerate infrastructure services on
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit a confirmed SMB vulnerability for
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit misconfigured Active Directory
日本語の概要は準備中です。原文の説明を表示しています。
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or...
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester escape from a containerized environment or
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit misconfigured AD CS certificate
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester enumerate and exploit Active Directory
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester enumerate and exploit Microsoft
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester with offline credential and file cracking.
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester force remote systems to authenticate
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester establish persistence through AD CS
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit writable Group Policy Objects
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester forge Kerberos tickets for domain
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester perform password spraying against
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester use credential material (NTLM hashes,
日本語の概要は準備中です。原文の説明を表示しています。