723 个 · 按相关度排序
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro
中文简介正在准备中。当前显示原文说明。
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix.
中文简介正在准备中。当前显示原文说明。
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf
中文简介正在准备中。当前显示原文说明。
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
中文简介正在准备中。当前显示原文说明。
Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.
中文简介正在准备中。当前显示原文说明。
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.
中文简介正在准备中。当前显示原文说明。
Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
中文简介正在准备中。当前显示原文说明。
Webサービスを攻撃者目線でレビューし、実在する攻撃ベクターに基づいて脆弱性を発見・整理するスキル。 静的レビューと実証検証は別サブエージェントに委任し、メインセッションは両者の結果を 査読・比較して次アクションを判断する。Medium以上の実証済み所見、または実証未了でも 優先度が高い所見がある場合はメインセッションで対策プランの作成を促す。 Trigger: 脆弱性レビュー, セキュリティ診断, 攻撃者目線レビュー, ペネトレーション観点, /dev:attack-surface-review, attack surface review, pentest perspective, exploit path
中文简介正在准备中。当前显示原文说明。
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
中文简介正在准备中。当前显示原文说明。
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
中文简介正在准备中。当前显示原文说明。
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
中文简介正在准备中。当前显示原文说明。
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.
中文简介正在准备中。当前显示原文说明。
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
中文简介正在准备中。当前显示原文说明。
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
中文简介正在准备中。当前显示原文说明。
Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.
中文简介正在准备中。当前显示原文说明。
Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
中文简介正在准备中。当前显示原文说明。
Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.
中文简介正在准备中。当前显示原文说明。
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
中文简介正在准备中。当前显示原文说明。
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
中文简介正在准备中。当前显示原文说明。
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
中文简介正在准备中。当前显示原文说明。
Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.
中文简介正在准备中。当前显示原文说明。
Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.
中文简介正在准备中。当前显示原文说明。
Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.
中文简介正在准备中。当前显示原文说明。
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
中文简介正在准备中。当前显示原文说明。