777 个 · 按相关度排序
Configure login state and access rules in Blazor Web Apps. Accounts for server and browser rendering, protects pages by role or policy, and helps diagnose missing authentication state or errors on Identity pages.
中文简介正在准备中。当前显示英语简介。
红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi
中文简介正在准备中。当前显示原文说明。
检查指定PR并与当前目标分支比较，区分已有问题与变更新增的问题，完成授权修复和必要验证，保留贡献者署名，并报告验证证据与待办事项。
Study authorized wireless devices beyond conventional Wi-Fi using SDR, software-defined radio. Identify signal characteristics, analyze protocols, and assess replay feasibility in shielded labs to evaluate unauthorized control risks and develop hardening recommendations.
中文简介正在准备中。当前显示英语简介。
Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.
中文简介正在准备中。当前显示英语简介。
Set up Havoc infrastructure for authorized attack simulations, including its command server, traffic listeners, Nginx relay servers, and Windows agents. The skill also covers communication profiles and operational precautions for running the infrastructure.
中文简介正在准备中。当前显示英语简介。
Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.
中文简介正在准备中。当前显示英语简介。
Prepare and publish Xiaohongshu posts, find relevant posts, and send authorized comments or replies using the selected account's browser. Manage drafts and media, verify visible outcomes, and record results in the operations panel.
中文简介正在准备中。当前显示英语简介。
检查未使用代码、重复状态及冗余API和层级，依据证据整理删除或合并候选项。可仅开展调查，也可在获准范围内实施修改并验证保留的功能。
根据已审核的合并请求计划，完成获准的修改与验证，保留贡献者的作者信息，并且只合并所有者明确授权的请求组，以证据说明合并结果和暂缓原因。
Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.
中文简介正在准备中。当前显示英语简介。
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
中文简介正在准备中。当前显示英语简介。
Analyze software protections during authorized reverse engineering, the examination of compiled programs. Helps identify mechanisms that hinder debugging, obscure code, or prevent tampering, then choose safe analysis methods, document findings, and develop defensive recommendations.
中文简介正在准备中。当前显示英语简介。
Guide authorized security assessments of REST, SOAP, and GraphQL APIs. Organize endpoint discovery, authentication checks, access control tests, and input testing, then document discovered weaknesses and evidence of unauthorized data access.
中文简介正在准备中。当前显示英语简介。
Assess authorized Wi-Fi networks through traffic capture, WPA/WPA2 handshake analysis, and rogue access point research. Follow a scoped workflow to evaluate password policies, wireless isolation, and access portals, then report findings and hardening recommendations.
中文简介正在准备中。当前显示英语简介。
Assess Windows and Active Directory identity security within an authorized scope. Map accounts and permissions, investigate authentication and certificate weaknesses, and document paths that could allow an attacker to gain greater access.
中文简介正在准备中。当前显示英语简介。
Check industrial process data servers for unauthorized clients and suspicious data patterns using a Python detector. Provides alerts for missing or constant values and investigation checks for attackers moving between IT and operational technology networks.
中文简介正在准备中。当前显示英语简介。
Detect unauthorized cryptocurrency mining in cloud workloads by combining billing changes, CPU usage, mining pool connections, and process alerts. Follow workflows to preserve evidence, isolate affected resources, and trace how attackers gained access.
中文简介正在准备中。当前显示英语简介。
Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.
中文简介正在准备中。当前显示英语简介。
Plan authorized spearphishing simulations, personalized phishing tests aimed at specific people. Prepare scenarios and email infrastructure, track delivery and participant responses, and document findings to assess email security controls and improve security awareness.
中文简介正在准备中。当前显示英语简介。
Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.
中文简介正在准备中。当前显示英语简介。
Assess whether stolen Kerberos tickets, credentials used for network authentication, can enable access to other systems during authorized testing. Guide ticket extraction and reuse, review detection indicators, and document evidence for security reports.
中文简介正在准备中。当前显示英语简介。
Set up and harden a Sliver server for authorized security exercises that simulate attackers. Cover multiple communication protocols, intermediary servers, certificate-based access for team members, and test programs that use periodic or interactive connections.
中文简介正在准备中。当前显示英语简介。
Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.
中文简介正在准备中。当前显示英语简介。