2,984 件 ・ 関連度順
概要と使いどころ
Identify and exploit misconfigured Linux Capabilities. This skill covers how attackers escalate privileges to root without relying on SUID binaries or kernel exploits by abusing excessive capabilities like cap_dac_read_search, cap_sys_ptrace, or cap_setuid assigned to ordinary files.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.
日本語の概要は準備中です。原文の説明を表示しています。
DOM-based XSS occurs when JavaScript reads attacker-controlled sources (`location.hash`, `document.referrer`, `window.name`, `location.search`) and passes them to dangerous sinks (`document.write`, `innerHTML`, `eval`, `location.href`, `setTimeout`, `jQuery.html()`) without sanitization. Unlike reflected/stored XSS, payloads never reach the server. Detect by auditing JavaScript for tainted data flow from DOM sources to sinks. Tools: Burp Suite DOM Invader, Chrome DevTools, DOMPurify (fix).
日本語の概要は準備中です。原文の説明を表示しています。
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema", "batching", or "alias". Applies to dual-stack REST+GraphQL apps, Relay-style global IDs, and unauthenticated resolvers.
日本語の概要は準備中です。原文の説明を表示しています。
Test organizational egress controls by executing various data exfiltration techniques during a red team engagement. Use this skill to simulate an adversary attempting to steal sensitive data without triggering DLP (Data Loss Prevention) or network monitoring alerts. Covers exfiltration over DNS, ICMP, HTTP/S, alternative protocols (SSH/FTP), cloud services, and physical methods.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Illicit Consent Grants in Azure Active Directory (Entra ID). This skill covers crafting a malicious OAuth application to trick victims into granting broad permissions (like reading emails, modifying files) without requiring their password or MFA.
日本語の概要は準備中です。原文の説明を表示しています。
Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.
日本語の概要は準備中です。原文の説明を表示しています。
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
日本語の概要は準備中です。原文の説明を表示しています。
Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.
日本語の概要は準備中です。原文の説明を表示しています。
Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.
日本語の概要は準備中です。原文の説明を表示しています。
Execute and analyze AI Data Poisoning attacks. By subtly injecting malicious or targeted misinformation into an LLM's training or fine-tuning dataset, an attacker can covertly manipulate the model's future outputs, implant backdoors, or enforce biases without altering the model architecture.
日本語の概要は準備中です。原文の説明を表示しています。
Top-level orchestrator for Flutter feature specification. Runs the full uninterrupted pipeline: prd → techspec → tasks in one shot. Use when the user says "spec a feature", "write a spec for", "start feature spec", "plan a feature", or wants to go from idea to implementation-ready tasks without typing three separate commands.
日本語の概要は準備中です。原文の説明を表示しています。
Transcribe audio files locally with Interpreter's builtin-transcribe tool server. Use when a user asks to transcribe speech from recordings without cloud transcription or API keys.
日本語の概要は準備中です。原文の説明を表示しています。
Runtime theming - applying a theme system to a live app without flash
日本語の概要は準備中です。原文の説明を表示しています。
Generate web, mobile, and desktop prototypes, slides, dashboards, and editorial layouts from a single prompt using brand-grade design systems. Use when the user wants /web-prototype, /mobile-app, or /dashboard interactive HTML previews exportable to HTML, PDF, PPTX, or MP4 without Figma.
日本語の概要は準備中です。原文の説明を表示しています。
Tired of juggling multiple audio APIs? This skill gives you one-command access to TTS, music generation, sound effects, and voice cloning. Use when you want to generate any audio without managing multiple API keys.
日本語の概要は準備中です。原文の説明を表示しています。
Tired of juggling 8 API keys? This skill gives you one-command access to Midjourney, Flux, Ideogram, and more, with zero setup. Use when you want to generate any image without worrying about API keys.
日本語の概要は準備中です。原文の説明を表示しています。
Procedure for controlled, human-gated outbound README badge provisioning PRs (Issue #1817). Preflights upstream repositories, ensures single-badge placement with deep links, and records campaign outcomes without automated retries or multi-badge noise.
日本語の概要は準備中です。原文の説明を表示しています。
Re-read pinned on-chain facts and watch documentary source fingerprints behind failure scenarios monthly, reporting drift without approving or changing scenario records automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and repair Pharos documentation against the codebase. Use for documentation update passes, verified-doc drift, source-path/doc-sync failures, methodology/doc routing updates, or requests to verify docs without trusting existing prose.
日本語の概要は準備中です。原文の説明を表示しています。