51 个（SnailSploit 的仓库） · 按人气排序
Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.
中文简介正在准备中。当前显示英语简介。
Evaluate older Wi-Fi clients and embedded devices for KRACK and FragAttacks vulnerabilities. Covers test suites, likely patch status, practical impact, and reporting findings by device, firmware version, and vulnerability identifier.
中文简介正在准备中。当前显示英语简介。
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
中文简介正在准备中。当前显示英语简介。
Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.
中文简介正在准备中。当前显示英语简介。
Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.
中文简介正在准备中。当前显示英语简介。
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
中文简介正在准备中。当前显示英语简介。
Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.
中文简介正在准备中。当前显示英语简介。
Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.
中文简介正在准备中。当前显示英语简介。
Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.
中文简介正在准备中。当前显示英语简介。
Support shellcode development for security testing: small machine-code programs executed in memory. The skill covers x86/x64 implementation, code that works regardless of its memory address, loaders, executable conversion, debugging, and platform-specific execution constraints.
中文简介正在准备中。当前显示英语简介。
Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.
中文简介正在准备中。当前显示英语简介。
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
中文简介正在准备中。当前显示英语简介。
Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.
中文简介正在准备中。当前显示英语简介。
Map wireless networks before a security assessment. Choose compatible adapters, configure packet capture, identify access points and clients, and record channels, encryption, and management frame protection across 2.4, 5, and 6 GHz bands.
中文简介正在准备中。当前显示英语简介。
Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.
中文简介正在准备中。当前显示英语简介。
Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.
中文简介正在准备中。当前显示英语简介。
Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.
中文简介正在准备中。当前显示英语简介。
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.
中文简介正在准备中。当前显示英语简介。
Assess Wi-Fi disconnection and reconnection behavior using deauthentication and disassociation tests. The skill covers client targeting, handshake capture, protected management frames, transmission scope and rate, and reporting observed effects and detection signals.
中文简介正在准备中。当前显示英语简介。
Assess LoRaWAN and sub-GHz wireless devices by capturing signals, examining packet formats, and checking key reuse and replay weaknesses, where recorded messages are resent. It covers IoT networks, fixed-code remotes, and proprietary radio protocols.
中文简介正在准备中。当前显示英语简介。
Organize red team exercises that simulate adversaries to assess an organization's detection and response. Covers engagement rules, infrastructure, operational controls, evidence handling, and reports that help security teams review gaps and prioritize improvements.
中文简介正在准备中。当前显示英语简介。
Turn penetration test and red team results into reports for executives and technical teams. Structure findings, explain severity scores and business impact, organize evidence, and document remediation steps and retest plans.
中文简介正在准备中。当前显示英语简介。
Plan and carry out wireless security assessments, from surveying nearby networks to checking authentication weaknesses and recording findings. Covers personal and enterprise Wi-Fi, rogue access points, and testing considerations for Wi-Fi 6, 6E, and 7.
中文简介正在准备中。当前显示英语简介。
Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.
中文简介正在准备中。当前显示英语简介。