45 个 · 按相关度排序
Analyze Windows authentication logs for repeated password guesses against Remote Desktop services. Group failures by source IP and account, check for later successful logins, and produce a JSON report highlighting attack patterns and possible compromise.
中文简介正在准备中。当前显示英语简介。
Expert guide for API rate limiting, bot protection, DDoS mitigation, brute-force prevention, and abuse detection / Panduan ahli untuk rate limiting API, perlindungan bot, mitigasi DDoS, pencegahan brute-force, dan deteksi penyalahgunaan.
中文简介正在准备中。当前显示原文说明。
Exploit GraphQL API architectural features to execute highly efficient brute-force, Credential Stuffing, and Denial of Service (DoS) attacks. Utilize Query Batching and Alias injection to bypass rate limits by packing thousands of requests into a single HTTP POST request.
中文简介正在准备中。当前显示原文说明。
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
中文简介正在准备中。当前显示原文说明。
JWT saldırıları — alg:none, HMAC brute-force, floating point bypass, CVE-2022-39227
中文简介正在准备中。当前显示原文说明。
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
中文简介正在准备中。当前显示原文说明。
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
中文简介正在准备中。当前显示原文说明。
Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.
中文简介正在准备中。当前显示英语简介。
Analyze authentication logs to spot suspicious sign-ins, password attacks, and possible account compromise. Statistical baselines and machine learning help compare login activity with normal user behavior, while example SIEM queries support security investigations.
中文简介正在准备中。当前显示英语简介。
Analyze Apache and Nginx access logs for attack attempts, scanner activity, and repeated login requests. Add geographic context to source IP addresses and produce a prioritized findings report to support intrusion investigations and monitoring reviews.
中文简介正在准备中。当前显示英语简介。
Assess WPS, a router feature for easy Wi-Fi setup, for weaknesses in PIN authentication. The skill covers device discovery, offline and online testing, lockout behavior, and how a recovered PIN can expose the network password.
中文简介正在准备中。当前显示英语简介。
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
中文简介正在准备中。当前显示英语简介。
Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.
中文简介正在准备中。当前显示英语简介。
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
中文简介正在准备中。当前显示原文说明。
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.
中文简介正在准备中。当前显示原文说明。
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.
中文简介正在准备中。当前显示原文说明。
Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.
中文简介正在准备中。当前显示原文说明。
Inspects and configures the web application firewall (WAF) in front of a Power Pages production site. Lists the current state, recommends enabling protection when it is off, and walks the user through adding, updating, or removing custom rules — IP blocks, country blocks, path blocks, and rate limits. Use when the user wants to turn on WAF, block traffic by IP or country, rate-limit login or signup pages, protect pages from brute-force attempts, restrict access to specific paths, review the current firewall configuration, or asks "is my site protected against bots / common web attacks?" — even if they say "add rate limit" or "protect login page" without mentioning "firewall" or "WAF".
中文简介正在准备中。当前显示原文说明。
Implement cheat codes, hidden interactions, and unlockable meta-content via time-windowed input sequence buffers, spam thresholds, look-at (dot-product) detectors, progress-% unlocks, and meta persistence in user://secrets.cfg. Use when adding Konami-style codes, curiosity spam eggs, glimmer cues, lockout anti-brute-force, or gallery flags that must survive slot deletes. Keywords: Konami, sequence buffer, meta secrets.cfg, visibility detector, lockout, glimmer, spam threshold, progress unlock.
中文简介正在准备中。当前显示原文说明。
Implement cheat codes, hidden interactions, and unlockable meta-content via time-windowed input sequence buffers, spam thresholds, look-at (dot-product) detectors, progress-% unlocks, and meta persistence in user://secrets.cfg. Use when adding Konami-style codes, curiosity spam eggs, glimmer cues, lockout anti-brute-force, or gallery flags that must survive slot deletes. Keywords: Konami, sequence buffer, meta secrets.cfg, visibility detector, lockout, glimmer, spam threshold, progress unlock.
中文简介正在准备中。当前显示原文说明。
Applies the reasoning style of Ilya Sutskever (deep learning pioneer, co-founder of OpenAI and Safe Superintelligence Inc.) to problems involving AI architecture, scaling laws, alignment, and research strategy. Reach for this skill whenever discussing machine learning paradigms, the limits of compute and data, AGI timelines, superintelligence safety, or deciding between hardcoding vs. learning. Trigger this skill for questions about next-word prediction, reinforcement learning efficiency, generalization gaps, and transitioning from brute-force scaling to fundamental research, even if the user doesn't explicitly name him.
中文简介正在准备中。当前显示原文说明。
Detects attacks from server logs and blocks malicious IPs with CrowdSec, an open-source, crowd-sourced alternative to fail2ban. Use when a user asks to block brute force attempts, protect SSH or a web server, set up a community blocklist firewall, add a WAF, or install CrowdSec with Docker.
中文简介正在准备中。当前显示原文说明。
Applies the reasoning style of Ilya Sutskever (deep learning pioneer, co-founder of OpenAI and Safe Superintelligence Inc.) to problems involving AI architecture, scaling laws, alignment, and research strategy. Reach for this skill whenever discussing machine learning paradigms, the limits of compute and data, AGI timelines, superintelligence safety, or deciding between hardcoding vs. learning. Trigger this skill for questions about next-word prediction, reinforcement learning efficiency, generalization gaps, and transitioning from brute-force scaling to fundamental research, even if the user doesn't explicitly name him.
中文简介正在准备中。当前显示原文说明。
Apply ant colony optimization and foraging theory to resource search, exploration-exploitation tradeoffs, and distributed discovery. Covers scout deployment, trail reinforcement, diminishing returns detection, and adaptive foraging strategy selection. Use when searching a large solution space where brute-force enumeration is impractical, balancing investment between exploring new approaches and deepening known good ones, optimizing resource allocation across uncertain opportunities, or diagnosing premature convergence on local optima.
中文简介正在准备中。当前显示原文说明。