“pentesting”的搜索结果

Run autonomous AI-driven penetration tests on web applications using tools like Shannon, PentAGI, and similar frameworks. Use when tasks involve setting up automated penetration testing pipelines, combining AI agents with security tools (nmap, subfinder, nuclei, sqlmap), building autonomous exploit chains, generating pentest reports with proof-of-concept exploits, or integrating AI pentesting into CI/CD pipelines. Covers the full pentest lifecycle from reconnaissance to reporting using AI orchestration.

中文简介正在准备中。当前显示原文说明。

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

中文简介正在准备中。当前显示原文说明。

iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.

中文简介正在准备中。当前显示原文说明。

iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.

中文简介正在准备中。当前显示原文说明。

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

中文简介正在准备中。当前显示原文说明。

ペネトレーションテストを対話的に実行するスキル。認可確認(Authorization Gate)→カテゴリ選択（Methodology, Reconnaissance, Scanning, VulnerabilityScanning, WebAppTesting, APITesting, PasswordAttacks, Exploitation, PrivilegeEscalation, ActiveDirectory, PostExploitation, WirelessAttacks, NetworkAttacks, SocialEngineering, CloudPentesting, MobileAppTesting, ContainerK8s, BinaryExploitation, OWASPTop10, Reporting, EmailSecurity, DatabaseAttacks, VPNRemoteAccess の全23カテゴリ）→ツール選択→コマンド実行→発見記録(Finding)→レポート生成をステップバイステップで進行。スコープ/除外チェック・ガードレール付き。「ペンテスト実行」「pentest」「侵入テスト」「脆弱性診断」「セキュリティテスト」「pentest executor」で発火。

中文简介正在准备中。当前显示原文说明。

Set up Strix security checks in CI/CD to test pull request changes, report verified vulnerabilities, and gate merges. Covers both a CLI running on your own infrastructure and a managed service with pull request comments.

中文简介正在准备中。当前显示英语简介。

• Check pull request changes for vulnerabilities before merging
• Add Strix scans to GitHub Actions or GitLab CI
• Choose between managed reviews and scans on your own runners

Run security tests for web apps, APIs, and source code on Strix Cloud without local Docker or an LLM key. Register targets, review findings in a team dashboard, export results, and configure recurring scans or PR reviews.

中文简介正在准备中。当前显示英语简介。

• Running security tests without local Docker
• Tracking vulnerability status across a team
• Scheduling scans and starting PR security reviews

Plan and conduct authorized security tests of AWS, Azure, and GCP environments. Check access permissions, credential exposure, cross-account access, and monitoring, then organize findings into a report with severity, business impact, and remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Assessing cloud security before production deployment
• Checking access controls after a cloud migration
• Testing monitoring and incident response readiness

Map sensitive data across the systems you manage, explore what a compromised asset could expose, and maintain a risk register. Record likelihood, impact, owners, mitigations, and review dates to support ongoing security planning.

中文简介正在准备中。当前显示英语简介。

• Locating sensitive data across managed systems
• Assessing the impact of a compromised server or worker
• Recording risk owners, mitigations, and review dates

This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain, exercises the supplied endpoints with the managed Security Agent service, and returns verified runtime findings. Use when the user asks to pentest, run a penetration test, test their app's attack surface, find runtime vulnerabilities, register or verify a target domain, or check pentest status / findings.

中文简介正在准备中。当前显示原文说明。

Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.

中文简介正在准备中。当前显示原文说明。

Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with network-accessible shells, IoT devices, or telnet services.

中文简介正在准备中。当前显示原文说明。

Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles.

中文简介正在准备中。当前显示原文说明。

Perform black-box / grey-box web application penetration testing on an authorized target — auth bypass, IDOR, session handling, business-logic flaws, parameter tampering, Burp Suite / OWASP ZAP workflows. Use when the user mentions 'web pentest,' 'web application penetration test,' 'pentesting,' 'bug bounty,' 'Burp Suite,' 'ZAP,' 'OWASP testing,' 'authentication testing,' 'session testing,' 'authorization testing,' 'business logic testing,' 'web vulnerability testing,' or has explicit authorization to test a live web application.

中文简介正在准备中。当前显示原文说明。

Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE

中文简介正在准备中。当前显示原文说明。

Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race

中文简介正在准备中。当前显示原文说明。

Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, CISA KEV (actively exploited) vulns, and 2026 attack patterns. Not for fixing vulnerabilities or pentesting.

中文简介正在准备中。当前显示原文说明。

Test web application security with Burp Suite. Use when a user asks to intercept HTTP traffic, test for web vulnerabilities, fuzz API endpoints, analyze authentication flows, or perform manual web application pentesting.

中文简介正在准备中。当前显示原文说明。

Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.

中文简介正在准备中。当前显示原文说明。

Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.

中文简介正在准备中。当前显示原文说明。

Exploit modern Windows environments that prefer IPv6 by using mitm6 to intercept and spoof DHCPv6 and DNS traffic. This skill covers how to poison DNS resolution for the local network, forcing NTLM authentication to a rogue server for credential capture or relay.

中文简介正在准备中。当前显示原文说明。

Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.

中文简介正在准备中。当前显示原文说明。