704 个 · 按相关度排序
Investigate IDOR, an access control flaw that exposes other users' resources through changed IDs. The skill guides REST API and GraphQL testing, checks boundaries between organizations, and helps document reproducible data exposure or unauthorized changes.
中文简介正在准备中。当前显示英语简介。
Assess GraphQL APIs in financial services for unauthorized transfers, rounding errors, duplicate transactions, and exposed personal data. The skill guides checks of account permissions and ledger changes to distinguish actual financial impact from misleading success responses.
中文简介正在准备中。当前显示英语简介。
Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.
中文简介正在准备中。当前显示英语简介。
Investigate CSRF, where a page causes unwanted actions through a signed-in user's session. The skill covers tokens, cookie settings, JSON APIs, and account linking, with guidance for browser-based demonstrations and assessing account or financial impact.
中文简介正在准备中。当前显示英语简介。
Investigate GraphQL APIs for unauthorized data access, unsafe updates, and permission inconsistencies with REST APIs. The skill covers schema discovery, checks across users and organizations, and validation steps that turn suspected weaknesses into reproducible findings with concrete impact.
中文简介正在准备中。当前显示英语简介。
Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.
中文简介正在准备中。当前显示英语简介。
Assess Laravel applications for exposed secrets, accessible dashboards, and authentication or permission flaws. The skill guides checks of debug settings, signed URLs, cookies, and model updates, with validation criteria for understanding the impact of findings.
中文简介正在准备中。当前显示英语简介。
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
中文简介正在准备中。当前显示英语简介。
Test CDN-backed websites for cache poisoning and Web Cache Deception, where private pages are mistakenly cached as public content. The skill guides cache behavior checks, input testing, and independent-client verification to establish reproducible impact.
中文简介正在准备中。当前显示英语简介。
Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.
中文简介正在准备中。当前显示英语简介。
Review access control, authentication flows, and configuration weaknesses across a service. The skill covers invitations, lingering sessions, token permissions, SAML sign-in, and internal APIs, with guidance for comparing response bodies and establishing concrete, reproducible impact.
中文简介正在准备中。当前显示英语简介。
Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.
中文简介正在准备中。当前显示英语简介。
Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.
中文简介正在准备中。当前显示英语简介。
Audit a repository or broad subsystem for security, correctness, and maintenance risks. Trace how inputs reach affected behavior, verify suspected defects, and report confirmed findings with severity, triggers, impact, and practical remedies.
中文简介正在准备中。当前显示英语简介。
Use Shodan to investigate internet-exposed devices and services on authorized targets. Guidance covers web searches, command-line tools, and APIs to compile asset inventories, review known vulnerability information, monitor networks, and export findings.
中文简介正在准备中。当前显示英语简介。
Guides security scanning across networks, web applications, wireless systems, and cloud environments. Helps select and configure tools, check findings for false positives, prioritize risks, and prepare reports with remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.
中文简介正在准备中。当前显示英语简介。
Review web application code against OWASP Top 10 (2021), a list of common security risks. Receive findings with file locations, severity ratings, concrete fix code, and a prioritized list of remediation tasks.
中文简介正在准备中。当前显示英语简介。
Assess web application login and session security, including password rules, multi-factor authentication, and password resets. The skill guides testing and documents weaknesses, session behavior, and recommendations for strengthening authentication.
中文简介正在准备中。当前显示英语简介。
Learn how to conduct an authorized penetration test, a security assessment that checks exploitable weaknesses. Follow guidance from initial research and scanning through validation, evidence collection, and reporting with remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Plan and coordinate penetration tests with checklists covering objectives, scope, environment preparation, tester selection, monitoring, and follow-up. Helps teams define deliverables, prioritize vulnerabilities, arrange fixes and verification, and clean up test accounts and artifacts.
中文简介正在准备中。当前显示英语简介。
Map an authorized target's subdomains, active websites, and technologies, then organize vulnerability checks with security tools. The skill covers reconnaissance workflows, automated scans, and XSS testing for flaws that let injected scripts run in web pages.
中文简介正在准备中。当前显示英语简介。
Audit sensitive code and dependencies for security weaknesses, then verify fixes with tests and repeat checks. Reports identify severity, file locations, and remediation steps for issues involving authentication, data protection, injection attacks, and configuration.
中文简介正在准备中。当前显示英语简介。