180 个 · 按相关度排序
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
中文简介正在准备中。当前显示英语简介。
Assess Bluetooth Classic devices such as older car kits, industrial sensors, and audio accessories. The skill guides device discovery, service inspection, authentication checks, and known vulnerability assessment, helping document exposed functions and device-specific findings.
中文简介正在准备中。当前显示英语简介。
Assess web applications and APIs for SQL injection, where input changes database queries. The skill covers finding vulnerable inputs, testing different database systems, automating checks, and documenting findings with remediation suggestions.
中文简介正在准备中。当前显示英语简介。
Audit GraphQL APIs for exposed schemas, missing access checks, injection risks, and weak query limits. Combine automated tools with targeted checks to investigate data exposure, unauthorized operations, and resource exhaustion, then document findings with reproducible evidence.
中文简介正在准备中。当前显示英语简介。
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
中文简介正在准备中。当前显示英语简介。
Map a website’s exposed services by collecting subdomains, active hosts, and current or historical URLs. Inspect JavaScript and exposed files, prioritize areas for security testing, and monitor new subdomains and GitHub commits.
中文简介正在准备中。当前显示英语简介。
Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.
中文简介正在准备中。当前显示英语简介。
Discover subdomains, live hosts, and URLs to build a prioritized map for web security testing. Includes JavaScript analysis, API specification discovery, and monitoring for new subdomains, JavaScript changes, and GitHub commits.
中文简介正在准备中。当前显示英语简介。
Assess internet-exposed VMware management services by identifying versions, matching known vulnerabilities, and checking authentication settings and information exposure. Use the findings to document affected services, supporting evidence, and the potential impact on virtual infrastructure.
中文简介正在准备中。当前显示英语简介。
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
中文简介正在准备中。当前显示英语简介。
Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
中文简介正在准备中。当前显示英语简介。
Investigate LDAP and XPath injection in directory searches and XML-backed authentication. The skill guides checks for login bypasses and information leaks, uses control responses to reduce false positives, and distinguishes Active Directory from other LDAP directories.
中文简介正在准备中。当前显示英语简介。
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
中文简介正在准备中。当前显示英语简介。
Assess login and verification code protections, identify response differences that reveal registered accounts, and distinguish visible blocks from silent throttling. The skill guides evidence gathering to verify weaknesses and assess their practical impact.
中文简介正在准备中。当前显示英语简介。
Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.
中文简介正在准备中。当前显示英语简介。
Guide Windows domain penetration testing through Active Directory reconnaissance, credential attacks, privilege escalation, and certificate service checks. Use references for tools such as BloodHound and Impacket to examine attack paths and understand testing prerequisites.
中文简介正在准备中。当前显示英语简介。
Set up HTTP, HTTPS, SNMP for device information, and SMB for file sharing in a penetration testing lab. Follow configuration and testing steps to inspect exposed information, check access permissions, and review service logs.
中文简介正在准备中。当前显示英语简介。
Guide authorized security reconnaissance, the collection of information about a target. Set investigation boundaries, identify alternative sources when discovery stalls, and organize domains, ports, services, and findings for prioritizing further security testing.
中文简介正在准备中。当前显示英语简介。
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
中文简介正在准备中。当前显示原文说明。
Enumerates chemical libraries through reaction SMARTS transformations using RDKit. Generates virtual compound libraries from building blocks using defined chemical reactions with product validation. Use when creating combinatorial libraries or enumerating products from synthetic routes.
中文简介正在准备中。当前显示原文说明。
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. Passive OSINT and analysis only -- no new active-intrusion technique. Use when setting up ongoing monitoring for a retainer or MSSP engagement, tuning alert thresholds to avoid fatigue, triaging a finding's lifecycle status, investigating adversary chatter about a brand, building a 'what changed on the perimeter since last week' report, or deciding whether a persisting finding should re-alert.
中文简介正在准备中。当前显示原文说明。
Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.
中文简介正在准备中。当前显示原文说明。