القائمة
Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
| name | cloud-containers |
| description | Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation. |
Test cloud infrastructure and container environments for security misconfigurations and exploitation paths.
| Platform | Key Vectors |
|---|---|
| AWS | S3 bucket exposure, IAM misconfig, metadata service, Lambda abuse |
| Azure | Blob storage, RBAC flaws, managed identity, App Service misconfig |
| GCP | Cloud Storage, service account keys, metadata server, IAM |
| Docker | Container escape, privileged mode, socket exposure, image vulnerabilities |
| Kubernetes | RBAC bypass, secret exposure, pod escape, API server access |
reference/cloud-security.md - Platform-specific attack guides (AWS, Azure, GCP, Docker, K8s)