测试与安全技能

Guide authorized SSRF assessments, which examine whether a server can be induced to request unintended destinations. The skill sets scope, suggests alternative investigation paths, and defines evidence for confirmed findings or reports of unsuccessful tests.

中文简介正在准备中。当前显示英语简介。

• Define the scope of an authorized SSRF assessment
• Reconsider investigation paths when request restrictions block tests
• Organize evidence that a server initiated a request

Guides authorized security testing after initial access, covering privilege escalation, persistence, movement between systems, and data access. Helps agents define boundaries, assess demonstrated access, and document evidence or obstacles before ending the investigation.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of testing after initial access
• Reviewing investigation options when privilege escalation stalls
• Documenting movement paths and the highest privileges obtained

Turn observed software names and versions into a prioritized list of known vulnerabilities using cve_lookup. Rank candidates by severity, available exploit code, and actual exposure, while keeping unconfirmed version matches clearly separate from verified findings.

中文简介正在准备中。当前显示英语简介。

• Finding CVE candidates from service names and versions
• Prioritizing vulnerabilities for verification
• Reviewing details of high-severity CVE matches

Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.

中文简介正在准备中。当前显示英语简介。

• Review prompt injection risks in AI applications
• Check MCP tool misuse and trust boundaries
• Assess agent permissions and credential misuse

Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.

中文简介正在准备中。当前显示英语简介。

• Capture Android app traffic during real user flows
• Investigate browser request signatures and tokens
• Analyze desktop client signing logic

Guide authorized security reconnaissance, the collection of information about a target. Set investigation boundaries, identify alternative sources when discovery stalls, and organize domains, ports, services, and findings for prioritizing further security testing.

中文简介正在准备中。当前显示英语简介。

• Define the scope of authorized reconnaissance
• Find alternative sources when discovery stalls
• Organize domains, IP addresses, ports, and services

Guide the scope, next checks, and evidence requirements for authorized CSRF testing, which examines unwanted requests sent through a user's browser. Covers token protection, SameSite cookie controls, and JSON requests, including reporting when evidence is insufficient.

中文简介正在准备中。当前显示英语简介。

• Define the scope of a CSRF assessment
• Review next checks when CSRF protections block testing
• Organize reproduction evidence and impact findings

Guides authorized network security testing of exposed services, weaker communication protocols, interception risks, and network segmentation. Helps agents set investigation boundaries and document network structure, demonstrated weaknesses, reachable systems, and reasons for inconclusive results.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of network security testing
• Reviewing exposed services and protocol weaknesses
• Assessing network segmentation and reachable systems

Guide authorized mobile app security testing across stored data, certificate checks, exposed components, and compiled code analysis. The skill organizes scope, alternative investigation paths, reproduction evidence, and completion criteria for findings and unsuccessful tests.

中文简介正在准备中。当前显示英语简介。

• Define scope for mobile app security testing
• Organize checks for stored data and exposed app components
• Choose another investigation path when app protections block testing

Guide authorized testing of security defenses, including web application firewalls, antivirus, and endpoint detection tools. The skill defines scope, alternative testing directions, evidence requirements, and completion criteria for reporting successful bypasses or unsuccessful attempts.

中文简介正在准备中。当前显示英语简介。

• Define scope for authorized security defense testing
• Choose another direction when testing stalls
• Organize evidence for a successful bypass

Guide systematic security testing of Web applications and APIs across input handling, authentication, business rules, protocols, files, and deployment settings. Use topic-specific references and playbooks, or step-by-step testing guides, to choose checks suited to the target.

中文简介正在准备中。当前显示英语简介。

• Planning input validation and injection testing
• Checking authentication and access control
• Reviewing GraphQL, WebSocket, and OAuth security

Guides authorized testing of XXE, a flaw involving external references processed in XML. Helps agents set boundaries, reconsider blocked test paths, and document evidence of file access or server requests before drawing conclusions.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of XXE testing
• Reviewing XML entry points in uploaded files
• Organizing evidence of entity processing and external requests

Guide authorized testing of open redirects, where a site sends visitors to an unintended destination. This skill defines test boundaries, alternative investigation paths, and the evidence needed to report findings or conclude an investigation.

中文简介正在准备中。当前显示英语简介。

• Define the scope of an authorized redirect test
• Review evidence for OAuth redirect_uri findings
• Choose another direction when redirect checks stall

Guide authorized SQL injection testing, where input may change database queries. Define scope, choose alternative investigation paths, and organize requests, responses, and impact evidence, including reports that document unsuccessful checks without claiming a vulnerability is absent.

中文简介正在准备中。当前显示英语简介。

• Define the scope of SQL injection testing
• Reconsider investigation paths after blocked attempts
• Organize reproduction evidence and impact findings

Guides authorized OS command injection testing by defining scope, alternative investigation paths, and evidence requirements. Helps agents document direct, blind, and argument injection findings and report inconclusive results without overstating what the evidence proves.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of command injection testing
• Reviewing investigation paths when responses are absent
• Organizing reproduction evidence and execution privileges

Guides authorized testing of file operation flaws, including path traversal, arbitrary file access, uploads, and file inclusion. Helps agents define boundaries, reconsider test directions, and document reproduction evidence and accessible file scope.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of file operation testing
• Reviewing alternatives when path or upload checks block progress
• Organizing file access evidence and impact assessments

Guide authorized cross-site scripting testing, where injected scripts run in a web page. Define test boundaries, choose alternative investigation paths, and document reproduction evidence before reporting findings or ending an inconclusive investigation.

中文简介正在准备中。当前显示英语简介。

• Define the scope of an authorized XSS assessment
• Choose another investigation path when checks stall
• Organize reproduction steps and script execution evidence

Guides authorized Active Directory security testing with scope boundaries, alternative testing directions, and evidence requirements. Helps agents document domain permissions, reproduction records, and observed impact before deciding whether findings are supported or testing should move elsewhere.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of Active Directory tests
• Reviewing stalled privilege escalation tests
• Organizing domain test evidence

Guides authorized testing of injection flaws outside SQL, where crafted input changes how a system interprets a request. Helps agents define scope, choose alternative directions, document reproduction evidence, and decide when findings justify a report.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of non-SQL injection testing
• Reconsidering test directions when progress stalls
• Organizing reproduction evidence and impact assessments

Structure authorized container security tests covering Docker escape, Kubernetes privilege escalation, image vulnerabilities, and network isolation. This skill defines scope, alternative investigation paths, and evidence requirements for reporting demonstrated access and its impact.

中文简介正在准备中。当前显示英语简介。

• Define the scope of an authorized container security test
• Review evidence of host access or increased cluster permissions
• Consider other paths when container checks stall

Assess candidate CVEs, identifiers for known vulnerabilities, against observed software, versions, and patch evidence. The skill helps determine whether to continue verification, gather more information, or change testing direction within the authorized scope.

中文简介正在准备中。当前显示英语简介。

• Checking whether candidate CVEs match observed software
• Reviewing patch status before further testing
• Identifying evidence gaps that require more reconnaissance

Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.

中文简介正在准备中。当前显示英语简介。

• Decoding strings with multiple layers of encoding
• Calculating hashes and checking likely hash formats
• Encrypting or decrypting data with a known key

Read a HackerOne program’s testing scope and rules, distinguish report eligibility from bounty eligibility, and pass supported assets to pentest-flow for security testing. Prepare separate findings in HackerOne report format for manual submission while enforcing scope and impact limits.

中文简介正在准备中。当前显示英语简介。

• Organizing allowed and excluded assets from a program
• Distinguishing report eligibility from bounty eligibility
• Testing one supported asset at a time within program rules

Guide authorized testing of business logic flaws, such as skipped payment steps, altered prices, concurrency issues, and permission errors. The skill helps define boundaries, choose further investigation paths, and organize reproduction evidence and business impact assessments.

中文简介正在准备中。当前显示英语简介。

• Defining the scope of business logic testing
• Choosing further checks for payment and permission flows
• Organizing reproduction steps and business impact evidence