测试设计、漏洞检测、质量保证（1.3万 个）
This playbook describes ways to establish remote command shells across Linux, Windows, and web servers. It covers encrypted connections, terminal upgrades for interactive use, file transfer options, PowerShell methods, and payload generation with msfvenom.
中文简介正在准备中。当前显示英语简介。
Start security reconnaissance on an unfamiliar application by confirming scope, mapping its attack surface, discovering related assets, and identifying technologies and endpoints. Use the resulting inventory to choose a focused first testing path instead of probing randomly.
中文简介正在准备中。当前显示英语简介。
Check OAuth 2.0 and OpenID Connect login flows for configuration weaknesses. The playbook guides reviews of redirect URI checks, state and nonce validation, PKCE, token issuer and audience, scopes, and account binding across web, mobile, and SPA clients.
中文简介正在准备中。当前显示英语简介。
Plan movement between Windows hosts using remote execution methods such as PsExec, WMI, WinRM, DCOM, and RDP. The playbook compares credential requirements and operational traces, covers hash and Kerberos ticket use, and explains tunneling through a compromised host.
中文简介正在准备中。当前显示英语简介。
A Windows security testing playbook covering ways attackers attempt to evade antivirus and endpoint detection tools. It organizes techniques involving AMSI, ETW telemetry, .NET assemblies, shellcode, process injection, API hooks, and signature checks.
中文简介正在准备中。当前显示英语简介。
Use this playbook to test CDN, reverse proxy, and application caching for path confusion and cache key weaknesses. It helps distinguish flaws that expose authenticated responses from those that cause malicious content to be served to other users.
中文简介正在准备中。当前显示英语简介。
Investigate why a web application firewall blocks an injection request and explore evasion methods for authorized security testing. The playbook covers encoding changes, HTTP protocol behavior, duplicate parameters, path normalization, content types, and WAF identification, with a decision process for choosing what to examine.
中文简介正在准备中。当前显示英语简介。
Review file upload features across validation, storage, processing, and delivery. The playbook helps testers find issues such as unsafe previews, exposed files, cross-user overwrites, and risky document or media processing paths.
中文简介正在准备中。当前显示英语简介。
Assess exposed management services such as Redis, Rsync, PHP-FPM, AJP, Hadoop YARN, and H2 Console. The playbook covers discovery, service-specific checks, and configuration hardening for unauthenticated access risks.
中文简介正在准备中。当前显示英语简介。
Use this playbook to investigate PCAP network captures with Wireshark and tshark. It covers protocol filters, traffic and file extraction, suspicious covert channels, capture repair, and TLS decryption workflows to help make recorded network activity understandable.
中文简介正在准备中。当前显示英语简介。
Use this playbook to inspect images, audio, files, and text for hidden data. It outlines format-specific checks and extraction approaches, from image metadata and audio spectrograms to embedded files, whitespace patterns, and invisible Unicode characters.
中文简介正在准备中。当前显示英语简介。
Examine isolation boundaries in Python and Lua sandboxes, seccomp, chroot, containers, browser processes, and restricted shells. The playbook helps identify the sandbox type and assess escape paths that could expose files or permit code execution.
中文简介正在准备中。当前显示英语简介。
Choose RSA cryptanalysis methods from the available parameters and observations. The playbook covers factoring weak moduli, small-exponent and shared-modulus attacks, partial information, padding oracles, and faulty signatures to help recover plaintext in CTFs or authorized assessments.
中文简介正在准备中。当前显示英语简介。
Use this security testing playbook to check whether proxies, CDNs, and origin servers disagree about HTTP request boundaries. It covers Content-Length and Transfer-Encoding differences, HTTP/2 downgrades, and browser-side desynchronization, with guidance for low-impact probes.
中文简介正在准备中。当前显示英语简介。
Test JavaScript applications for prototype pollution, where untrusted keys alter shared object behavior. The playbook helps inspect parsers and merge operations, verify persistent effects, and assess whether later code paths turn the issue into a security impact.
中文简介正在准备中。当前显示英语简介。
Investigate file path handling in downloads, includes, imports, and archive extraction. The playbook helps distinguish arbitrary file reads from local file inclusion, and maps common encoding, filter, platform, and PHP wrapper behaviors to test.
中文简介正在准备中。当前显示英语简介。
Use this skill to test applications that build NoSQL queries from user input. It covers MongoDB operator injection, authentication bypass, blind data extraction, aggregation pipelines, and Redis or CouchDB risks, with detection ideas and testing checklists.
中文简介正在准备中。当前显示英语简介。
Plan security assessments of network protocols such as ARP, name resolution, DHCPv6, VLANs, DNS, and IPv6. The guide explains how these techniques can expose credentials or redirect traffic, and helps select an approach based on network conditions.
中文简介正在准备中。当前显示英语简介。
Use this skill to review JWT signing, keys, claims, bearer-token handling, and OAuth flows. It provides checks for token trust, account binding, redirects, and leakage paths, helping assess authentication weaknesses during authorized security testing.
中文简介正在准备中。当前显示英语简介。
Evaluate macOS protections such as TCC, Gatekeeper, SIP, app sandboxing, and code signing in authorized security assessments. The playbook outlines bypass patterns, version considerations, entitlement checks, and persistence options.
中文简介正在准备中。当前显示英语简介。
Use this guide to inspect redirects controlled by URL parameters, form actions, or JavaScript. It outlines ways to find unsafe external redirects, check validation behavior, and understand how redirect issues can affect sign-in or server-side URL flows.
中文简介正在准备中。当前显示英语简介。
Use this playbook to test web applications for race conditions, where simultaneous requests can pass a check before state changes. It covers one-time actions, balances, inventory, rate limits, and synchronized HTTP/1.1 or HTTP/2 testing, with evidence to confirm inconsistent results.
中文简介正在准备中。当前显示英语简介。
Use this skill to examine ways code can enter macOS processes, including dynamic library loading, XPC services, Mach ports, and Electron apps. It outlines prerequisites and protections that affect each method, supporting security reviews and forensic investigation.
中文简介正在准备中。当前显示英语简介。
Use this playbook to assess NTLM relay paths in Windows domain environments. It maps SMB, LDAP, HTTP, and MSSQL targets, explains signing and channel binding constraints, and covers ways to trigger authentication for authorized security testing.
中文简介正在准备中。当前显示英语简介。