“penetration-testing”的搜索结果

AWS Penetration Testing workflow skill. Use this skill when the user needs Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

中文简介正在准备中。当前显示原文说明。

AWS Penetration Testing workflow skill. Use this skill when the user needs Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

中文简介正在准备中。当前显示原文说明。

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools

中文简介正在准备中。当前显示原文说明。

Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through systematic attack simulation.

中文简介正在准备中。当前显示原文说明。

Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.

中文简介正在准备中。当前显示英语简介。

• Security testing an application or API
• Testing source code alongside a deployed application
• Choosing between local and cloud execution

Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.

中文简介正在准备中。当前显示英语简介。

• Security testing a staging web application
• Checking access between accounts and organizations
• Testing a local development server

Support authorized penetration testing of AWS environments by examining IAM permissions and resources such as S3, EC2, and Lambda. It guides identifying privilege escalation paths, where access can be expanded, and documenting security audit findings.

中文简介正在准备中。当前显示英语简介。

• Review IAM permissions for privilege escalation paths
• Assess access to S3 buckets and Lambda functions
• Validate credential exposure risks through EC2 metadata

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.

中文简介正在准备中。当前显示英语简介。

• Check API responses for excessive sensitive data
• Test whether added request fields allow unauthorized updates
• Compare field access across user privilege levels

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.

中文简介正在准备中。当前显示英语简介。

• Finding administrative pages accessible without signing in
• Checking authentication requirements on APIs
• Locating exposed configuration and backup files

Plan and run authorized security exercises that simulate an attacker's actions, from reconnaissance to activities after entry. Map techniques to MITRE ATT&CK, a framework of attack behaviors, and report detection gaps and response performance.

中文简介正在准备中。当前显示英语简介。

• Planning the scope and objectives of a red team exercise
• Designing scenarios based on a specific threat actor
• Measuring detection and response during an exercise

Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Check stored iOS app data for sensitive information
• Inspect HTTPS traffic during authorized testing
• Observe authentication behavior without source code

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.

中文简介正在准备中。当前显示原文说明。

Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.

中文简介正在准备中。当前显示原文说明。

STRIDE threat modeling, DREAD risk scoring, secret detection, and secure architecture design. Use when conducting threat models, reviewing code for vulnerabilities, designing defense-in-depth, or scanning for hardcoded secrets.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "plan a red team engagement", "scope a penetration test", "design a security assessment methodology", "create rules of engagement", or "plan an adversary simulation".

中文简介正在准备中。当前显示原文说明。

Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.

中文简介正在准备中。当前显示原文说明。

Test web application security with Burp Suite. Use when a user asks to intercept HTTP traffic, test for web vulnerabilities, fuzz API endpoints, analyze authentication flows, or perform manual web application pentesting.

中文简介正在准备中。当前显示原文说明。