“misconfiguration”的搜索结果

Audit Azure Blob and ADLS storage accounts for public exposure, risky access tokens, encryption settings, and insecure transport configurations. Use the azure-mgmt-storage Python SDK to produce a JSON report with account findings, severity ratings, and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing storage accounts across an Azure subscription
• Investigating suspected exposure through public blob access
• Reviewing SAS token permissions and expiration

Assess Azure, AWS, and GCP security through resource inventories, authentication checks, permission reviews, and misconfiguration testing. Supports authorized assessments that document exposed credentials, rate risks, and recommend improvements for each cloud platform.

中文简介正在准备中。当前显示英语简介。

• Inventorying cloud resources and permissions
• Checking for exposed credentials and secrets
• Testing the impact of cloud misconfigurations

bu skill provides step-by-step procedures for identifying and remediating Amazon S3 bucket misconfigurations that expose sensitive data to unauthorized access. It covers enabling S3 Block Public Access at account and bucket levels, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and Dağıt:ing automated remediation using AWS Config and Lambda.

中文简介正在准备中。当前显示原文说明。

Helps address Google Cloud Security Command Center findings by planning targeted fixes for permissions, misconfigurations, vulnerabilities, and combined attack paths. It includes impact checks, verification, rollback steps, and execution after user approval.

中文简介正在准备中。当前显示英语简介。

• Fix excessive permissions flagged by Security Command Center
• Plan fixes for exposed buckets or firewall rules
• Address attack paths involving multiple security issues

Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Assessing Linux privilege escalation paths
• Practicing privilege escalation in CTF challenges
• Reviewing sudo and scheduled task configurations

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

中文简介正在准备中。当前显示英语简介。

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.

中文简介正在准备中。当前显示英语简介。

• Reviewing package registry settings in CI/CD
• Finding internal package names in lock files
• Planning an authorized callback-based proof of concept

Review API configuration and input handling for unauthorized field updates, prototype pollution that alters shared object defaults, and manipulation of backend URLs. The skill also covers exposed API specifications and access control weaknesses in OData queries.

中文简介正在准备中。当前显示英语简介。

• Checking whether profile updates accept privileged fields
• Verifying the effects of prototype pollution
• Inspecting backend URL construction

OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

中文简介正在准备中。当前显示原文说明。

CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.

中文简介正在准备中。当前显示原文说明。

Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps. Use when the user mentions 'cloud security,' 'cloud audit,' 'AWS security,' 'GCP security,' 'Azure security,' 'IAM audit,' 'S3 bucket,' 'cloud misconfiguration,' 'cloud hardening,' or needs to review cloud infrastructure security.

中文简介正在准备中。当前显示原文说明。

Audit an existing Kubernetes cluster — find misconfigurations, security gaps, and resource issues. Use when asked to "audit our Kubernetes cluster", "find K8s misconfigurations", or "check cluster security gaps".

中文简介正在准备中。当前显示原文说明。

OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

中文简介正在准备中。当前显示原文说明。

CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.

中文简介正在准备中。当前显示原文说明。

Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.

中文简介正在准备中。当前显示原文说明。

Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda function abuse, and cross-account attack paths. Covers both external and authenticated AWS pentesting.

中文简介正在准备中。当前显示原文说明。

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

中文简介正在准备中。当前显示原文说明。

Use when working with Trivy — trivy comprehensive security scanner. Covers container image scanning, filesystem scanning, Kubernetes cluster scanning, SBOM generation, secret detection, license scanning, and misconfiguration detection. Use when scanning containers for vulnerabilities, generating SBOMs, scanning K8s clusters, or detecting misconfigurations.

中文简介正在准备中。当前显示原文说明。

Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and deviations from security best practices.

中文简介正在准备中。当前显示原文说明。

Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and Şunu üret:ctionable security reports.

中文简介正在准备中。当前显示原文说明。

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

中文简介正在准备中。当前显示原文说明。

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

中文简介正在准备中。当前显示原文说明。

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

中文简介正在准备中。当前显示原文说明。