“exploit”的搜索结果

Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.

中文简介正在准备中。当前显示英语简介。

• Designing authorized phishing simulations for specific personnel
• Preparing test email delivery infrastructure
• Measuring delivery, opens, clicks, and reporting behavior

Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.

中文简介正在准备中。当前显示英语简介。

• Establish recurring infrastructure vulnerability scans
• Prioritize fixes using asset importance and exploitation data
• Track remediation deadlines and overdue findings

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Build runnable Foundry tests that demonstrate smart contract vulnerabilities with before-and-after logs and assertions. Use fork tests, which copy blockchain state, and test helpers to reproduce known DeFi incidents or prepare evidence for a report.

中文简介正在准备中。当前显示英语简介。

• Writing runnable proofs of concept for vulnerability reports
• Reproducing issues from a fixed blockchain block
• Controlling callers, time, and balances in tests

Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.

中文简介正在准备中。当前显示英语简介。

• Prioritizing a static analysis finding before proof-of-concept work
• Checking whether entry points can reach a suspicious function
• Preparing code evidence for exploit validation

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

中文简介正在准备中。当前显示英语简介。

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.

中文简介正在准备中。当前显示英语简介。

• Checking whether a reported vulnerability is real
• Verifying the conditions needed to exploit a finding
• Reviewing suspected false positives

Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.

中文简介正在准备中。当前显示英语简介。

• Checking NetExec authentication options
• Enumerating domain users and shared resources
• Collecting data for BloodHound

Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.

中文简介正在准备中。当前显示英语简介。

• Assessing template rendering endpoints
• Identifying the template engine in use
• Evaluating information exposure and code execution risks

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

中文简介正在准备中。当前显示英语简介。

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.

中文简介正在准备中。当前显示英语简介。

• Investigating privilege escalation in authorized Windows assessments
• Reviewing service and scheduled task permissions
• Checking detection coverage with attack and defense teams

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

中文简介正在准备中。当前显示英语简介。

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Investigate TOCTOU flaws: race conditions where a checked property changes before an action uses it. The skill covers filesystem, kernel, web, and container testing, helping identify vulnerable sequences, reproduce timing issues, and document observed impact.

中文简介正在准备中。当前显示英语简介。

• Reviewing file checks before privileged operations
• Testing access revocation during long-running requests
• Investigating duplicate payments from concurrent requests

Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.

中文简介正在准备中。当前显示英语简介。

• Planning authorized phone and SMS security tests
• Reviewing visitor and badge verification procedures
• Designing USB device security exercises

Turn raw security findings into a ranked list for engineering review. Check claims against source code, merge duplicates, assess how feasible exploitation is, and assign component owners, with results in JSON and Markdown.

中文简介正在准备中。当前显示英语简介。

• Validating security scanner findings
• Merging duplicate findings across scans
• Prioritizing a vulnerability backlog

Review EVM and Solana tokens for hidden minting, blocked sales, fee changes, and liquidity withdrawal risks. Combine code scanning with checks of privileged controls to identify mechanisms that could enable a rug pull, or issuer exit scam.

中文简介正在准备中。当前显示英语简介。

• Reviewing token risks before an investment
• Checking Solana mint and freeze authorities
• Scanning token code for suspicious controls

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.

中文简介正在准备中。当前显示原文说明。