59 个 · 按相关度排序
Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.
中文简介正在准备中。当前显示英语简介。
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
中文简介正在准备中。当前显示英语简介。
Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.
中文简介正在准备中。当前显示英语简介。
在授权渗透测试中挖掘不安全反序列化（insecure deserialization）。当目标把用户可控数据交给 unserialize/Marshal/pickle/ObjectInputStream/BinaryFormatter/YAML.load 等还原成对象时使用——典型场景：cookie/token/viewstate/隐藏字段里出现序列化数据、导入文件触发对象还原、想借 gadget chain 拿 RCE。适用目标类型 Web / REST API（PHP/Ruby/Python/Java/.NET）。触发场景包括用户说"测下反序列化""这个 cookie 是不是序列化对象""能不能 gadget chain 打 RCE""phar/Marshal/pickle 打一下"。输出：识别出的序列化落点 + gadget 可用性判定 + 带外/回显证据的 finding（含 killed 记录）。
中文简介正在准备中。当前显示原文说明。
Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications.
中文简介正在准备中。当前显示原文说明。
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
中文简介正在准备中。当前显示原文说明。
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
中文简介正在准备中。当前显示原文说明。
在授权渗透测试中挖掘 JavaScript 原型污染（prototype pollution，服务端 Node.js 与客户端）。当目标把用户可控的键名递归合并进对象（merge/extend/set/clone、JSON body、query 解析）时使用——典型场景：用 `__proto__`/`constructor.prototype` 注入属性，污染全局原型，进而 DoS、改逻辑、配合 gadget 提权到 XSS/RCE。适用目标类型 Web / REST API（Node.js） / 前端。触发场景包括用户说"测下原型污染""这个 merge 能不能 __proto__""污染原型打 RCE/XSS""lodash/jquery 有没有污染点"。输出：污染点 + 可用 gadget 判定 + 反射证据的 finding（含 killed 记录）。
中文简介正在准备中。当前显示原文说明。
JavaScript prototype pollution — Object.prototype'u kirleterek auth bypass, RCE, XSS gadget chains (server-side Node.js ve client-side)
中文简介正在准备中。当前显示原文说明。
Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.
中文简介正在准备中。当前显示英语简介。
Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.
中文简介正在准备中。当前显示英语简介。
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.
中文简介正在准备中。当前显示原文说明。
Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.
中文简介正在准备中。当前显示原文说明。
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
中文简介正在准备中。当前显示原文说明。
Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.
中文简介正在准备中。当前显示原文说明。
Measure ACSets better than authors via surjectivity gadgets, Betti numbers, Möbius classification, and p-adic ultrametric distance
中文简介正在准备中。当前显示原文说明。
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
中文简介正在准备中。当前显示原文说明。
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
中文简介正在准备中。当前显示原文说明。
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
中文简介正在准备中。当前显示原文说明。
Diagnoses and fixes CI failures and re-runs GitHub Actions jobs. Use when CI is failing, tests break in CI, lint errors block merging, a build fails, or jobs need re-running.
中文简介正在准备中。当前显示原文说明。
Stack buffer overflow + ROP chain ile kontrol akışı ele geçirme — NX etkin, canary yok senaryoları için eksiksiz tarif
中文简介正在准备中。当前显示原文说明。
Sigreturn Oriented Programming (SROP) — sigreturn syscall ile tüm registerları tek payload'da kontrol etme; gadget kıtlığında ROP alternatifi
中文简介正在准备中。当前显示原文说明。
Diagnoses and fixes CI failures and re-runs GitHub Actions jobs. Use when CI is failing, tests break in CI, lint errors block merging, a build fails, or jobs need re-running.
中文简介正在准备中。当前显示原文说明。
Create comprehensive technical design for a specification
中文简介正在准备中。当前显示原文说明。