「server-side」の検索結果

SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.

日本語の概要は準備中です。原文の説明を表示しています。

Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.

日本語の概要は準備中です。原文の説明を表示しています。

Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions `{{7*7}}` returning `49`, or `${7*7}`, `<%= 7*7 %>`. Leads to full RCE via template sandbox escape, Python `__class__.__mro__` traversal, and Java reflection chains. Tools: tplmap, Burp Suite.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit DOM-based Cross-Site Scripting (XSS) vulnerabilities where malicious payloads are executed entirely within the victim's browser via insecure JavaScript execution, often bypassing server-side WAFs completely.

日本語の概要は準備中です。原文の説明を表示しています。

DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities to extract AWS IAM credentials from the Instance Metadata Service version 2 (IMDSv2). This skill details how to bypass the token requirement of IMDSv2 by chaining HTTP verbs (PUT then GET) if the SSRF vulnerability allows full control over the request headers and methods.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities on Amazon Web Services (AWS) EC2 instances to access the highly sensitive Instance Metadata Service (IMDS). Circumvent basic protections and extract temporary IAM access keys, escalating privileges comprehensively across the AWS Cloud environment.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.

日本語の概要は準備中です。原文の説明を表示しています。

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

日本語の概要は準備中です。原文の説明を表示しています。

Exploit AI assistants equipped with web-browsing capabilities or internal API plugins to perform Server-Side Request Forgery (SSRF). This skill details injecting prompts that force the LLM to request sensitive internal endpoints, such as underlying cloud metadata services or internal networks.

日本語の概要は準備中です。原文の説明を表示しています。

Full instrumentation from day one. PostHog consolidates product analytics + feature flags + error tracking (one platform, one bill). GA4 via GTM (14-step automation, custom dimensions over events, server-side tagging). Sentry (deep error tracking + performance). Stripe (webhook-first with idempotent processing). Listmonk on Coolify (newsletters via Amazon SES SMTP relay). PLG 7-layer framework. Programmatic SEO (5 page types). Incident auto-remediation via Sentry→Inngest pipeline. AI search (GEO) awareness. Local business conversions (phone_click, direction_click, form_submit, booking_click) with CRO patterns for both SaaS and local.

日本語の概要は準備中です。原文の説明を表示しています。

Frappe backend guidance for Python and backend-adjacent JavaScript surfaces such as client interaction patterns, hooks, APIs, patches, scheduler logic, reports, and server-side review. Use when implementing or reviewing Frappe backend behavior.

日本語の概要は準備中です。原文の説明を表示しています。

TanStack Table v8 patterns - useReactTable, column definitions, sorting, filtering, pagination, row selection, virtual scrolling, server-side data

日本語の概要は準備中です。原文の説明を表示しています。

Clerk managed authentication - ClerkProvider, middleware, pre-built components, hooks, server-side auth, organizations, webhooks

日本語の概要は準備中です。原文の説明を表示しています。

Full-funnel paid advertising operations for B2B SaaS. Use this skill for PPC strategy, Google Ads optimization, LinkedIn Ads, social media advertising, programmatic buying, creative strategy, attribution modeling, budget allocation, budget pacing and planned-vs-delivered reconciliation, audience overlap and campaign self-competition audits, suppression lists, ROAS improvement, media spend optimization, and the media no auction sells — newsletter and podcast sponsorships, community and industry-publication placements, paid review-site listings on G2 and Capterra, and pay-per-lead content syndication. It also covers buying on the AI answer surface — ads inside Google AI Overviews and AI Mode that existing Search, Shopping and Performance Max campaigns already serve into with no opt-out, no placement targeting and no segmented reporting, and ChatGPT Ads and Microsoft Copilot as separate opt-in platforms with their own plan-tier reach limits, no negative keywords, and a landing-page crawler gate. It also owns the conversion signal the bidding algorithms learn from — CRM pipeline stages (SQL, opportunity, closed-won) sent back to Google Ads, LinkedIn, Meta and Microsoft Ads through offline conversion import, enhanced conversions for leads, the Google Data Manager API and the LinkedIn Conversions API, with click-ID capture, stage values, dedupe, EEA consent signals and retractions. It also gates connected TV (CTV) and streaming video for B2B — whether a reach medium belongs in the plan, how a vendor ties a TV household to a target account (member data, IP-to-account graph or contextual), the server-side ad insertion (SSAI) fraud questions, Programmatic Guaranteed deals, and a holdout lift test because CTV has no click. It also runs person-led paid social — LinkedIn Thought Leader Ads and Meta partnership ads that put spend behind an employee's or creator's post — on a paid-usage term, an in-post disclosure check and an end-date register, because the platform approval carries no term. Also triggers on: CTV, connected TV, OTT, streaming TV ads, should we run CTV, LinkedIn CTV, B2B CTV, account-based CTV, SSAI fraud, thought leader ads, boost an employee's post, sponsor a creator's post, partnership ads, whitelisting, creator usage rights, PPC, Google Ads, LinkedIn Ads, social ads, programmatic, ad creative, attribution, media budget, paid campaigns, ROAS, CPA, ad spend, newsletter sponsorship, podcast sponsorship, community sponsorship, sponsor a newsletter, content syndication, pay-per-lead, cost per lead vendor, media kit, rate card, insertion order, direct buy, publisher partnership, make-good, G2 paid listing, Capterra ads, review site advertising, sponsorship ROI, budget pacing, we underspent our budget, are our campaigns competing with each other, audience overlap, self-competition, campaign cannibalization, suppression list, exclusion list, ad frequency across channels, how many ad accounts do we have, ads in AI Overviews, AI Mode ads, ChatGPT Ads, OpenAI Ads Manager, Copilot ads, conversational ads, should we advertise on ChatGPT, can we buy our way into the AI answer, our ads are showing in AI Overviews and we cannot report on it, context hints, OAI-AdsBot, our ad landing page fails review, robots.txt is blocking our ads, our paid leads are junk, Google Ads is optimizing for the wrong leads, offline conversion import, OCI, enhanced conversions for leads, send CRM stages back to Google Ads, upload SQLs to LinkedIn, LinkedIn Conversions API, LinkedIn CAPI, Meta conversion leads, CRM to ad platform, gclid, li_fat_id, msclkid, value-based bidding, optimize for pipeline not form fills, low match rate, conversion lag.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze game monetization implementations including IAP purchase flow and server-side receipt validation, ad mediation waterfall and rewarded video placement, subscription lifecycle and grace period handling, battle pass XP progression.

日本語の概要は準備中です。原文の説明を表示しています。

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

日本語の概要は準備中です。原文の説明を表示しています。

Implement server-side rendering and hydration in Angular v20+ using @angular/ssr. Use for SSR setup, hydration strategies, prerendering static pages, and handling browser-only APIs. Triggers on SSR configuration, fixing hydration mismatches, prerendering routes, or making code SSR-compatible.

日本語の概要は準備中です。原文の説明を表示しています。

Appwrite PHP SDK skill. Use when building server-side PHP applications with Appwrite, including Laravel and Symfony integrations. Covers user management, database/table CRUD, file storage, and functions via API keys.

日本語の概要は準備中です。原文の説明を表示しています。

Appwrite Go SDK skill. Use when building server-side Go applications with Appwrite. Covers user management, database/table CRUD, file storage, and functions via API keys. Uses per-service packages and functional options pattern.

日本語の概要は準備中です。原文の説明を表示しています。

Appwrite Ruby SDK skill. Use when building server-side Ruby applications with Appwrite, including Rails and Sinatra integrations. Covers user management, database/table CRUD, file storage, and functions via API keys.

日本語の概要は準備中です。原文の説明を表示しています。

Appwrite Rust SDK skill. Use when building server-side Rust applications with Appwrite. Covers async client setup with API keys, user management, TablesDB database/table/row operations, file storage, function executions, permissions, queries, and error handling. Uses the crates.io `appwrite` package and Tokio.

日本語の概要は準備中です。原文の説明を表示しています。

Appwrite .NET SDK skill. Use when building server-side C# or .NET applications with Appwrite, including ASP.NET and Blazor integrations. Covers user management, database/table CRUD, file storage, and functions via API keys.

日本語の概要は準備中です。原文の説明を表示しています。