“test”的搜索结果

Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplificat...

中文简介正在准备中。当前显示原文说明。

OAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.

中文简介正在准备中。当前显示原文说明。

HTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit writable files, filesystem misconfigurations,

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester enumerate a Windows system for local privilege

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester enumerate a Linux system for local privilege

中文简介正在准备中。当前显示原文说明。

You are conducting a post-engagement retrospective for a penetration tester.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit scheduled tasks, services, and inter-process

中文简介正在准备中。当前显示原文说明。

9 distinct paths. ATO is a destination class, not a single bug — each path below is a primitive that becomes Critical only when you demonstrate takeover of a SECOND account (test account B) you do not control, from attacker A's session/IP/device. A path that only locks you out of your own account, or only works when you already hold the victim's password AND session, is not a standalone ATO.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester escalate privileges on a Windows system by

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit Linux kernel vulnerabilities and escape

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester bypass User Account Control to escalate from

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit sudo misconfigurations, SUID/SGID binaries,

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester escalate privileges on a Windows system by

中文简介正在准备中。当前显示原文说明。

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

中文简介正在准备中。当前显示原文说明。

Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester find and extract locally stored credentials on a

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester exploit kernel vulnerabilities, vulnerable drivers,

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester enumerate database services and check for

中文简介正在准备中。当前显示原文说明。

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester pivot through compromised hosts to reach

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester enumerate remote access services (FTP, SSH,

中文简介正在准备中。当前显示原文说明。

You are helping a penetration tester bypass AV/EDR that is blocking payload

中文简介正在准备中。当前显示原文说明。

Systematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.

中文简介正在准备中。当前显示原文说明。