“web-security”的搜索结果

OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments

中文简介正在准备中。当前显示原文说明。

Web高级安全测试 — 注入攻击族、协议安全、认证与逻辑漏洞、文件与部署安全、现代Web攻击面，含完整Playbook

中文简介正在准备中。当前显示原文说明。

Test web application security with Burp Suite. Use when a user asks to intercept HTTP traffic, test for web vulnerabilities, fuzz API endpoints, analyze authentication flows, or perform manual web application pentesting.

中文简介正在准备中。当前显示原文说明。

Security review and implementation guidance for Odoo website, portal, public controllers, JSON routes, QWeb output, and browser-facing assets. Use when exposing Odoo data over HTTP, adding portal/public pages or forms, using sudo, handling tokens, rendering HTML, or reviewing web attack surfaces.

中文简介正在准备中。当前显示原文说明。

Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.

中文简介正在准备中。当前显示原文说明。

Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.

中文简介正在准备中。当前显示原文说明。

Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).

中文简介正在准备中。当前显示原文说明。

Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).

中文简介正在准备中。当前显示原文说明。

Exploit advanced HTTP Request Smuggling combining Transfer-Encoding vulnerabilities (TE.TE). By obscuring the Transfer-Encoding header, an attacker forces desynchronization between a frontend proxy (which processes the request one way) and the backend server (which processes it another way), allowing the smuggling of malicious requests to bypass security controls or poison caches.

中文简介正在准备中。当前显示原文说明。

Identify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.

中文简介正在准备中。当前显示原文说明。

Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.

中文简介正在准备中。当前显示原文说明。

Identify and exploit SQL Injection vulnerabilities in Django applications, specifically focusing on edge cases involving raw querysets (`RawSQL`), improper use of `.extra()`, and poorly sanitized filters where Django's typical ORM protections are bypassed.

中文简介正在准备中。当前显示原文说明。

Master Burp Suite Professional for comprehensive web application security testing. Use this skill when performing manual web application assessments with Burp Suite including proxy interception, Scanner automation, Intruder attacks, Repeater analysis, and extension integration. Covers advanced techniques like match-and-replace rules, macro authentication, Collaborator for OOB testing, and Turbo Intruder for high-speed fuzzing.

中文简介正在准备中。当前显示原文说明。

Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.

中文简介正在准备中。当前显示原文说明。

Aggregate SAST, SCA, DAST, secrets, API, frontend, and backend security checks into one report.

中文简介正在准备中。当前显示原文说明。

Run user-authorized black-box web security tests and evidence-based reports. Use for 黑盒安全测试、渗透测试、数据泄露、未授权访问、公开 JS/API、登录爆破防护、CORS 或安全响应头检查。

中文简介正在准备中。当前显示原文说明。

Develop Burp Suite extensions in Java (Montoya API) or Python (Jython). Supports creating HTTP listeners, scanner checks, intruder payloads, UI tabs, and context menus. Includes project templates, multi-platform setup guides, and best practices.

中文简介正在准备中。当前显示原文说明。

Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.

中文简介正在准备中。当前显示原文说明。

Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.

中文简介正在准备中。当前显示原文说明。

Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.

中文简介正在准备中。当前显示原文说明。