1,199 件 ・ 関連度順
概要と使いどころ
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Execute lateral movement within Active Directory environments using credential material (NTLM hashes and Kerberos tickets) instead of plaintext passwords. Use this skill when engaging in red team operations or internal network penetration tests to expand access, bypass authentication portals, and achieve Domain Dominance without relying on crackable passwords.
日本語の概要は準備中です。原文の説明を表示しています。
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Exploit PHP object serialization vulnerabilities (Insecure Deserialization). This skill details how to identify unserialize() injection points and construct malicious serialized objects using Property Oriented Programming (POP) chains to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Exploit implementations of JSON Web Tokens (JWT) through algorithmic confusion (e.g., RS256 to HS256), "none" algorithm attacks, and signature stripping. Use this skill to forge administration tokens and achieve unauthenticated Account Takeover (ATO) on REST APIs and modern web applications.
日本語の概要は準備中です。原文の説明を表示しています。
Test Large Language Models for direct prompt injection vulnerabilities where user input overrides system instructions, extracts system prompts, bypasses safety filters, or causes unauthorized actions. Use this skill when assessing chatbots, AI assistants, LLM-powered tools, or any application that processes natural language input through an LLM. Covers role-playing attacks, instruction hierarchy exploitation, multi-turn manipulation, and context window abuse for comprehensive AI security testing.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigured Docker environments, specifically focusing on privilege escalation via an exposed Docker daemon socket (`docker.sock`) or membership in the local `docker` user group to achieve root access on the host system.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit CVE-2023-36884, a critical Remote Code Execution vulnerability in Windows and Office associated with the Storm-0978 APT. This skill covers the weaponization of malicious Word documents to achieve code execution upon opening, bypassing Mark-of-the-Web (MotW) defenses.
日本語の概要は準備中です。原文の説明を表示しています。
Execute lateral movement within Microsoft Entra ID (formerly Azure AD) and Microsoft 365 environments. Use this skill to traverse cloud resources using compromised user tokens, managed identities, Primary Refresh Tokens (PRT), and application permissions (Service Principals) to achieve Global Administrator access.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit OS Command Injection vulnerabilities where web applications insecurely pass user input into system shell commands. Use this skill when applications feature ping utilities, file conversions, network diagnostics, or PDF generators to execute arbitrary system commands and achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.
日本語の概要は準備中です。原文の説明を表示しています。
Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent Threat (APT) establishing deep persistence that survives password resets.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive ISA-101 design rules for Human Machine Interfaces in process automation, with detailed reference files covering color design, display hierarchy, navigation, alarms, human factors, performance, and lifecycle management. Use when designing, building, reviewing, or generating code for HMIs, control system displays, SCADA screens, or industrial control panels and comprehensive ISA-101 coverage is needed. Use when deep-diving into alarm design, color standards, navigation patterns, human factors, performance requirements, or HMI lifecycle management.
日本語の概要は準備中です。原文の説明を表示しています。
Meaning-first animation with 3-tier hierarchy. CSS scroll-driven (animation-timeline: scroll()), View Transitions API, @starting-style DOM-insert, container scroll-state queries, prefers-reduced-motion mandatory on all animations.
日本語の概要は準備中です。原文の説明を表示しています。
React Testing Library — query hierarchy, userEvent, async utilities, renderHook, custom render with providers. Load when writing or reviewing tests that render React components or hooks.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
日本語の概要は準備中です。原文の説明を表示しています。
Design or revise Interpreter UI for non-developers with an ultra-minimal, utilitarian style inspired by the OpenAI website and ChatGPT, not the developer platform. Use when simplifying settings, onboarding, chat, forms, empty states, or helper copy; when removing extra containers, labels, or visual noise; when replacing technical wording with plain language; when clarifying hierarchy and making the main user action obvious; when making every visible label and status understandable to an average HR admin or other non-technical user; when hiding implementation details such as logs, IDs, endpoints, paths, or protocol names; or when a screen must respect the app's existing CSS variables and light/dark theme behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Audit essays, reports, literature reviews, dissertations, proposals, and source-backed assignments for high-score academic quality. Use when the user asks whether a paper can get a high grade, wants teacher/rubric feedback addressed, needs a pre-submission review, or needs checks for strict rubric compliance, academic standards, prompt/rubric alignment, argument quality, comparative analysis, evidence hierarchy, table/figure integration, citation specificity, conclusion strength, academic language, source-claim integrity, or evidence boundaries.
日本語の概要は準備中です。原文の説明を表示しています。
State machine patterns for Unity including hierarchical states, async transitions, and cleanup safety.
日本語の概要は準備中です。原文の説明を表示しています。