「variants」の検索結果

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Dependency confusion / supply chain (internal package-name discovery, unclaimed-name confirmation, callback-only PoC, npm/pip/Maven/RubyGems variants). Use when hunting a specific vuln class or studying what makes bugs pay.

日本語の概要は準備中です。原文の説明を表示しています。

EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.

日本語の概要は準備中です。原文の説明を表示しています。

Framework-based cold email composer with 3 personalization tiers. Generates subject line, body, and follow-up variants. Never uses templates -- builds from frameworks (PAS, BAB, AIDA, Signal-Proof-Ask).

日本語の概要は準備中です。原文の説明を表示しています。

Generates starter component code using design tokens. Creates React/Vue/Svelte components with proper token usage, variants, and accessibility built in.

日本語の概要は準備中です。原文の説明を表示しています。

Expert-level idiomatic Rust API design — the patterns that make illegal states unrepresentable and abstractions zero-cost. Type-state programming (PhantomData state machines), newtype + sealed + extension traits, typestate builders, RAII guards & Drop ordering, the interior-mutability decision tree (Cell/RefCell/Mutex/RwLock/Atomic/OnceLock), enum-driven state machines, error architecture (thiserror vs anyhow), dyn vs generic dispatch & object safety, the impl Trait / GAT / RPITIT toolbox, and Deref-for-smart-pointers (and its abuse). Use when designing a Rust library's public API, encoding invariants in the type system, choosing a dispatch or error strategy, or reviewing Rust for idiom. NOT for borrow-checker firefighting / toolchain / test-runner workflow (use rust-development-workflow), NOT for pd-console GPUI rendering/layout/panes (use gpui-rust-console), NOT for app packaging/notarization (use rust-app-distribution).

日本語の概要は準備中です。原文の説明を表示しています。

Audit a compliance-ladder design (C0-C6) and transcript-fidelity ladder (T0-T5) plus their adapter conformance fixtures — Codex, Claude Code, Cloudflare, Ollama/LM Studio, custom stdio/HTTP agents — for the two failure modes that make a C-badge or T-fidelity label a lie: the ladder disagreeing with itself across doc/schema/ui/probe surfaces, and a level being reachable by self-report because no daemon-witnessed negative probe actually tries to forge it. Use when designing or freezing a compliance ladder, wiring an adapter conformance probe suite, deciding whether a numeric C-badge or T-label is safe to ship, or investigating a self-attestation or observed-to-controlled bypass risk. NOT for auditing a cryptographic protocol or whitepaper for adversarial soundness (`redteam-review`), writing TLA+/formal invariants for a daemon monitor (`runtime-verification-for-agents`), or agent identity, successor linkage, and reputation across restarts (`agent-identity-continuity-reputation`).

日本語の概要は準備中です。原文の説明を表示しています。

Construct a finite oriented simplicial or cellular cochain model and compute its stated linear invariants when coefficient spaces, maps, metrics, and observations are explicit. Use for scoped Hodge, rank, or residual calculations; not for attributing agent intent or authorizing effects. NOT for attributing intent, identifying a liar, or authorizing external effects.

日本語の概要は準備中です。原文の説明を表示しています。