“misc”的搜索结果

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

中文简介正在准备中。当前显示原文说明。

Detecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption settings, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage.

中文简介正在准备中。当前显示原文说明。

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

中文简介正在准备中。当前显示原文说明。

Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error ...

中文简介正在准备中。当前显示原文说明。

Comprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse via GTFOBins, Linux capabilities exploitation (cap_setuid, cap_dac_override, cap_dac_read_search), sudo misconfigurations including NOPASSWD rules and Baron Samedit (CVE-2021-3156), cron job abuse through writable scripts, PATH hijacking, and wildcard injection with tar/rsync/chown. Includes writable /etc/passwd attacks, NFS no_root_squash exploitation, kernel exploits (DirtyPipe CVE-2022-0847, DirtyCow CVE-2016-5195, PwnKit CVE-2021-4034), Docker group container escapes, LD_PRELOAD and LD_LIBRARY_PATH hijacking for shared library injection, systemd service misconfigurations, and sensitive file enumeration for credential harvesting. Integrates automated enumeration with LinPEAS, linux-exploit-suggester, pspy for process monitoring, and GTFOBins for binary exploitation. Each technique includes detection signatures and defender-sid...

中文简介正在准备中。当前显示原文说明。

Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Dependency confusion / supply chain (internal package-name discovery, unclaimed-name confirmation, callback-only PoC, npm/pip/Maven/RubyGems variants). Use when hunting a specific vuln class or studying what makes bugs pay.

中文简介正在准备中。当前显示原文说明。

使用AgentShield检查Claude Code配置，报告硬编码秘密信息、权限过宽和恶意指令注入等风险，生成含严重程度与评级的报告，并自动修复部分问题。

• 启用Claude Code时检查配置
• 权限或MCP配置更改后审计
• 加入仓库时检查已有配置

记录网站登录流程，检查携带认证信息的跨站重定向、CSRF防护、会话Cookie暴露及OAuth配置，并按检查项目生成附有严重程度和判定结果的报告。

• 上线前检查登录流程
• 调查疑似令牌泄露
• 排查认证过程中的重定向

Assess an application against OWASP Top 10:2025 risk categories using Strix. Get findings backed by working exploit examples, organized by category, with clear explanations of what was tested and what remains unassessed.

中文简介正在准备中。当前显示英语简介。

• Assessing an app against OWASP Top 10:2025
• Testing access controls across users and tenants
• Organizing proven vulnerabilities by risk category

Design agents that operate desktop or browser software through screenshots, mouse actions, and keyboard input. Compare ways to locate interface elements, diagnose coordinate errors, handle changing screens, and evaluate task completion, operating speed, and safety boundaries.

中文简介正在准备中。当前显示英语简介。

• Designing screen-based automation for software without APIs
• Comparing methods for locating interface elements
• Investigating misclicks and coordinate scaling errors

Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.

中文简介正在准备中。当前显示英语简介。

• Reviewing database exposure and TLS settings
• Checking account privileges and sensitive table access
• Assessing dangerous features and configuration weaknesses

Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.

中文简介正在准备中。当前显示英语简介。

• Review redirect and token checks in a single sign-on flow
• Assess SAML signatures and assertion handling
• Investigate tenant confusion and logout failures

Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.

中文简介正在准备中。当前显示英语简介。

• Reviewing cloud permissions and public storage settings
• Assessing container isolation and escape paths
• Checking Kubernetes permissions and Secrets handling

Use CloudFox to inspect AWS and Azure resources through read-only queries. Identify exposed endpoints, secrets, permissions, and role trust relationships, then organize findings into files for reviewing configuration weaknesses and potential paths to broader access.

中文简介正在准备中。当前显示英语简介。

• Inventorying an unfamiliar AWS or Azure account
• Finding internet-facing resources
• Mapping role trust relationships and permissions

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.

中文简介正在准备中。当前显示英语简介。

• Auditing storage settings across Azure subscriptions
• Investigating publicly accessible blob containers
• Verifying encryption, network, and logging controls

Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.

中文简介正在准备中。当前显示英语简介。

• Enabling TLS 1.3 on nginx or Apache
• Configuring encrypted connections in a Python application
• Disabling outdated TLS versions and weak encryption

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.

中文简介正在准备中。当前显示英语简介。

• Reviewing Terraform modules and plans before deployment
• Adding security checks to Terraform CI/CD pipelines
• Enforcing organization-specific infrastructure rules

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations

Review cloud permissions, public storage access, network rules, and infrastructure definitions for security gaps. The skill helps identify risky configurations, rank findings by severity, and suggest narrower permissions, with fuller coverage for AWS than Azure or GCP.

中文简介正在准备中。当前显示英语简介。

• Reviewing cloud settings before deployment
• Finding excessive permissions and privilege escalation paths
• Checking public storage and exposed ports

Configure GKE logging, metrics collection, dashboards, and alerts with Cloud Logging, Cloud Monitoring, and managed Prometheus. Diagnose missing measurements, collection failures, permission errors, and alert rule problems to identify appropriate configuration changes.

中文简介正在准备中。当前显示英语简介。

• Setting up GKE logging and metrics collection
• Investigating missing Prometheus metrics
• Planning dashboards and alerts for cluster health

Review a proposed working arrangement before work begins. Apply researched legal tests for the relevant location and purpose, compare employee, independent contractor, agency temp, and vendor structures, and identify gaps between the intended arrangement and the facts.

中文简介正在准备中。当前显示英语简介。

• Reviewing a contractor arrangement before work begins
• Comparing agency temp and vendor structures
• Checking classification across legal purposes