“access-control”的搜索结果

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

中文简介正在准备中。当前显示原文说明。

アクセス制御分析エージェント - ゼロトラストモデルに基づくアクセス制御の現状分析と移行準備評価。/access-control-analysis [対象パス] で呼び出し。

中文简介正在准备中。当前显示原文说明。

Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected unauthorized API data access
• Creating detection rules for repeated identifier probing
• Reviewing API logging and rate limits

Audit, detect, and remediate Shadow Credentials misconfigurations on msDS-KeyCredentialLink in Active Directory. Focuses on access-controls, monitoring Event ID 5136, and credential-management hygiene.

中文简介正在准备中。当前显示原文说明。

This skill enables Claude to audit access control implementations in various systems. It uses the access-control-auditor plugin to identify potential vulnerabilities and misconfigurations related to access control. Use this skill when the user asks to "audit access control", "check permissions", "assess access rights", or requests a "security review" focused on access management. It's particularly useful for analyzing IAM policies, ACLs, and other access control mechanisms in cloud environments, applications, or infrastructure. The skill helps ensure compliance with security best practices and identify potential privilege escalation paths.

中文简介正在准备中。当前显示原文说明。

Review communication between different websites for security issues. Inspect code and browser behavior to identify overly broad CORS permissions, unchecked message senders, missing request protections, and unsafe redirects, then propose fixes and browser checks.

中文简介正在准备中。当前显示英语简介。

• Review CORS settings for authenticated endpoints
• Check sender validation in postMessage listeners
• Inspect redirects after login or SSO

Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.

中文简介正在准备中。当前显示英语简介。

• Security testing an application or API
• Testing source code alongside a deployed application
• Choosing between local and cloud execution

Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.

中文简介正在准备中。当前显示英语简介。

• Implement authorization with PKCE for web and mobile apps
• Configure authorization for service-to-service communication
• Review token storage, renewal, and revocation

Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.

中文简介正在准备中。当前显示英语简介。

• Adding Duo authentication to VPN and remote server access
• Strengthening authentication for privileged accounts
• Restricting access based on device health

Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.

中文简介正在准备中。当前显示英语简介。

• Designing tiered Active Directory administration
• Separating privileged accounts by administrative tier
• Planning dedicated administration workstations

Strengthen LDAP and Active Directory services by reviewing encrypted connections, signing, channel binding, access controls, and audit logging. Use the guidance to organize security settings, validate them in a test environment, and document implementation evidence.

中文简介正在准备中。当前显示英语简介。

• Reviewing LDAP or Active Directory security settings
• Organizing encrypted connections and authentication protections
• Checking audit logging and monitoring arrangements

Analyze existing user permissions to propose roles for role-based access control, which assigns permissions by job role. Compare candidate role sets, identify overlap and excess access, and validate definitions against business responsibilities.

中文简介正在准备中。当前显示英语简介。

• Consolidating overlapping access roles
• Redesigning roles from existing permission data
• Reviewing excess and unusual permissions

Audit Solidity contracts in Foundry projects before deployment using code analysis, randomized tests, manual review, and private key checks. Produces a JSON report with findings, remediation, test coverage, and a pass or fail deployment decision.

中文简介正在准备中。当前显示英语简介。

• Auditing Solidity contracts before deployment
• Adding fuzz and invariant tests for contracts that move funds
• Reviewing private key storage and deployment scripts

Audit AWS S3 buckets for public exposure, excessive permissions, and gaps in encryption or versioning settings. Use AWS CLI, Prowler, and access analysis to compile findings, prioritize issues, and plan or apply configuration fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing S3 settings in a newly onboarded AWS account
• Investigating alerts about publicly exposed buckets
• Preparing periodic access control audit reports

Audit Kubernetes RBAC, the rules that assign access through roles, to identify excessive permissions, risky role assignments, and paths to gaining higher privileges. Review service accounts and produce findings with recommended permission changes.

中文简介正在准备中。当前显示英语简介。

• Reviewing access permissions in shared Kubernetes clusters
• Finding accounts that can read secrets or gain higher privileges
• Checking service account token mounts

Audit Kubernetes access rules to find excessive permissions and service account token abuse paths. Trace which users or workloads could gain cluster administrator access, then produce prioritized findings and recommendations for reducing permissions.

中文简介正在准备中。当前显示英语简介。

• Reviewing Kubernetes privilege escalation paths
• Checking permissions after an RBAC change
• Tracing workloads with overprivileged service accounts

Review security across web apps, APIs, mobile apps, Kubernetes, and AI agents using six OWASP references. Identify risky authentication, access controls, configurations, and prompt handling, then use examples and checklists to plan fixes.

中文简介正在准备中。当前显示英语简介。

• Review login flows and access controls
• Check API authorization and data exposure
• Review mobile app storage and communications

Design Google Cloud systems where multiple AI agents process live audio, video, or text and respond in real time. Guides requirements discovery, architecture diagrams, infrastructure code, deployment instructions, and validation for technical guidance or safety monitoring workloads.

中文简介正在准备中。当前显示英语简介。

• Design real-time technical guidance using live audio and video
• Plan hazard detection and visual inspection from video streams
• Create cloud architecture diagrams and deployment instructions

Audit Solidity contracts in Foundry projects before deployment using code analysis, randomized tests, manual review, and private key checks. Produces a JSON report with findings, remediation, test coverage, and a pass or fail deployment decision.

中文简介正在准备中。当前显示英语简介。

• Auditing Solidity contracts before deployment
• Adding fuzz and invariant tests for contracts that move funds
• Reviewing private key storage and deployment scripts

Audit and fix four access-control problems in Convex apps: impersonation, missing ownership checks, sensitive data exposure, and writes into another user's container. Check the authentication foundation first, then verify changes with TypeScript.

中文简介正在准备中。当前显示英语简介。

• Check whether callers can impersonate another user
• Restrict document access to its owner
• Review queries that expose sensitive data

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

中文简介正在准备中。当前显示英语简介。

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

中文简介正在准备中。当前显示原文说明。

Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization. Trigger with 'audit access control', 'check permissions', or 'validate authorization'.

中文简介正在准备中。当前显示原文说明。