285 件 ・ 関連度順
概要と使いどころ
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
日本語の概要は準備中です。原文の説明を表示しています。
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
日本語の概要は準備中です。原文の説明を表示しています。
Applies the reasoning of David Silver, lead researcher on AlphaGo and AlphaZero at DeepMind, to problems of AI design, reinforcement learning, and open-ended discovery. Use this skill whenever you are designing AI systems, evaluating learning algorithms, balancing exploration vs. exploitation, choosing research problems, or discussing how to break past human performance ceilings. Reach for this whenever the user asks about self-play, Monte-Carlo Tree Search, tabula rasa learning, AGI, or moving from human-curated data to autonomous experience. It helps shift the focus from hardcoding human knowledge to building systems that learn for themselves.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze vulnerable code to identify underlying root causes such as violated assumptions, incorrect invariants, missing validation checks, or unsafe component interactions. Use when investigating security vulnerabilities, CVEs, exploit code, or security audit findings. Infers why the vulnerability exists beyond surface symptoms, identifies systemic issues, and explains the chain of failures that enable exploitation.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze detected vulnerabilities to assess realistic exploitability by examining control flow, input sources, sanitization logic, and execution context. Use when users need to: (1) Determine if a vulnerability is actually exploitable in practice, (2) Assess severity and impact of security issues, (3) Prioritize vulnerability remediation, (4) Understand attack vectors and exploitation conditions, (5) Generate exploitability reports with proof-of-concept scenarios. Focuses on injection vulnerabilities (SQL, command, XSS, path traversal, LDAP) with detailed analysis of reachability, controllability, sanitization, and impact.
日本語の概要は準備中です。原文の説明を表示しています。
The order of operations for an Active Directory penetration test: setup, collection, exploitation, post-processing. Use this whenever you are planning or driving an AD assessment and need to know what to run before what and why (map before you exploit; harvest easy credentials before spraying to avoid lockouts; collect the graph before you reason about paths). Covers phase sequencing with standard tooling: netexec/nxc, impacket, certipy, bloodyAD, kerbrute, BloodHound CE. Invoke it at the start of an engagement, when deciding the next phase, or when a step feels out of order.
日本語の概要は準備中です。原文の説明を表示しています。
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
日本語の概要は準備中です。原文の説明を表示しています。
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
日本語の概要は準備中です。原文の説明を表示しています。
AWS Penetration Testing workflow skill. Use this skill when the user needs Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
AWS Penetration Testing workflow skill. Use this skill when the user needs Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Applies the reasoning of David Silver, lead researcher on AlphaGo and AlphaZero at DeepMind, to problems of AI design, reinforcement learning, and open-ended discovery. Use this skill whenever you are designing AI systems, evaluating learning algorithms, balancing exploration vs. exploitation, choosing research problems, or discussing how to break past human performance ceilings. Reach for this whenever the user asks about self-play, Monte-Carlo Tree Search, tabula rasa learning, AGI, or moving from human-curated data to autonomous experience. It helps shift the focus from hardcoding human knowledge to building systems that learn for themselves.
日本語の概要は準備中です。原文の説明を表示しています。
Vocabulary learning strategies and retention science for any language -- frequency-based word selection, spaced repetition systems (Ebbinghaus forgetting curve, Leitner system, SM-2 algorithm), cognate exploitation, word family networks, context-based learning, collocations, depth of word knowledge (form, meaning, use), reading progression from controlled to authentic texts, and productive vs. receptive vocabulary thresholds. Use when building vocabulary plans, optimizing review schedules, selecting learning materials, or diagnosing vocabulary gaps.
日本語の概要は準備中です。原文の説明を表示しています。
Use after an Anabasis run, comparison, or system change and before claiming improvement. Attributes movement to one owner, reports identities and censored denominators, separates deterministic proof from model judgement, keeps measurement validity apart from observed exploitation, and states what remains unrun or provisional.
日本語の概要は準備中です。原文の説明を表示しています。
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.
日本語の概要は準備中です。原文の説明を表示しています。
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
日本語の概要は準備中です。原文の説明を表示しています。
OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.
日本語の概要は準備中です。原文の説明を表示しています。
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account trust, serverless/compute control, and cloud-native persistence. Host OS persistence/C2 after root/SYSTEM belongs to /post. K8s RBAC belongs to /k8s. Operator chooses next modules; new identities default to /cloud-recon first.
日本語の概要は準備中です。原文の説明を表示しています。
Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape including CVE-2026-31431 Copy Fail, and Kubernetes-native persistence. Use when already in a Pod/container or holding kubeconfig. Own the chain to cluster-admin, node root, or a usable cloud identity. Operator chooses next modules. Endpoint blocks after OS execution hand off to /edr-bypass then return.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP/Web exploitation until a server shell or equivalent OS execution. Use after /web-recon has mapped the application. Covers injection, upload, LFI, SSRF/XXE, SSTI, deserialization, JWT/SAML, API logic, desync/cache/parser, and Web-controlled backend abuse. WAF stays here. Endpoint blocks after OS execution hand off to /edr-bypass then return. Direct non-HTTP service ports belong to /recon or /service-attack.
日本語の概要は準備中です。原文の説明を表示しています。
Shell and session operations after an attack module already established command execution, a raw shell, webshell channel, container/runner shell, or remote session. This module does not own exploitation and should not pull SSH/WinRM/RDP authentication or vulnerability-to-shell chains out of Web/AD/Cloud/K8s/CI-CD/Service/Phishing. Use it to bootstrap a usable callback from existing command execution, stabilize Linux PTY, upgrade Windows sessions with ConPTY where applicable, manage listeners, recover fragile sessions, and exchange files for continued operations.
日本語の概要は準備中です。原文の説明を表示しています。