查找技能

You are helping a penetration tester exploit XXE injection. The target application

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit Insecure Direct Object Reference

中文简介正在准备中。当前显示原文说明。

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.

中文简介正在准备中。当前显示原文说明。

Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.

中文简介正在准备中。当前显示原文说明。

WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.

中文简介正在准备中。当前显示原文说明。

Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester bypass two-factor authentication. The

中文简介正在准备中。当前显示原文说明。

WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.

中文简介正在准备中。当前显示原文说明。

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.

中文简介正在准备中。当前显示原文说明。

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment).

中文简介正在准备中。当前显示原文说明。

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester deploy webshells to web server document

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit PHP deserialization

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit Apache JServ Protocol (AJP)

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit UNION-based SQL injection. The

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit file inclusion vulnerabilities. The

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit Cross-Origin Resource Sharing

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit NoSQL injection vulnerabilities.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit server-side template injection in a

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit Java deserialization

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit stored (persistent) cross-site

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit HTTP request smuggling

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit browser-based attack surfaces. This

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit reflected cross-site scripting. The

中文简介正在准备中。当前显示原文说明。