braydos-h/BreachPilot - الصفحة ٤

testing-cors-misconfiguration

Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.

لغة النص الأصلي: الإنجليزية

testing-for-broken-access-control

Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.

لغة النص الأصلي: الإنجليزية

testing-for-business-logic-vulnerabilities

Identifying flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what technical vulnerability scanners can detect.

لغة النص الأصلي: الإنجليزية

testing-for-email-header-injection

Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.

لغة النص الأصلي: الإنجليزية

testing-for-host-header-injection

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

لغة النص الأصلي: الإنجليزية

testing-for-json-web-token-vulnerabilities

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.

لغة النص الأصلي: الإنجليزية

testing-for-open-redirect-vulnerabilities

Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.

لغة النص الأصلي: الإنجليزية

testing-for-sensitive-data-exposure

Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.

لغة النص الأصلي: الإنجليزية

testing-for-xml-injection-vulnerabilities

Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.

لغة النص الأصلي: الإنجليزية

testing-for-xss-vulnerabilities

Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation. The tester identifies…

لغة النص الأصلي: الإنجليزية

testing-for-xss-vulnerabilities-with-burpsuite

Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.

لغة النص الأصلي: الإنجليزية

testing-for-xxe-injection-vulnerabilities

Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

لغة النص الأصلي: الإنجليزية

testing-jwt-token-security

Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

لغة النص الأصلي: الإنجليزية

testing-oauth2-implementation-flaws

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server,…

لغة النص الأصلي: الإنجليزية

testing-websocket-api-security

Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via…

لغة النص الأصلي: الإنجليزية

triaging-vulnerabilities-with-ssvc-framework

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.

لغة النص الأصلي: الإنجليزية

conducting-external-reconnaissance-with-osint

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records,…

لغة النص الأصلي: الإنجليزية

performing-privilege-escalation-assessment

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries,…

لغة النص الأصلي: الإنجليزية

cloud-ir-playbook

Run a structured cloud incident-response playbook — scope the blast radius across IAM/object-store/compute, preserve forensic state, and revoke live access without destroying telemetry.

لغة النص الأصلي: الإنجليزية

lateral-movement-decision-trees

Decision-tree methodology for authorized lateral movement — gate each pivot on the target-IP allowlist, pick the movement primitive from the foothold type, and cap recursion depth.

لغة النص الأصلي: الإنجليزية

llm-grammar-fuzzing

Fuzz an LLM or LLM tool layer with grammar-aware payloads — context-free-grammar-derived mutation, output-schema violation, and role-directive injection against the model's own input contract.

لغة النص الأصلي: الإنجليزية

prompt-injection-defense

Apply layered prompt-injection defenses to an LLM agent — input/output guardrails, tool-call allowlisting, context isolation, and adversarial test cases drawn from known payloads.

لغة النص الأصلي: الإنجليزية

quantum-crypto-triage

Triage post-quantum cryptography migration risk — identify classical-crypto dependencies, assess harvest-now-decrypt-later exposure, and prioritize quantum-vulnerable assets.

لغة النص الأصلي: الإنجليزية

supply-chain-attribution

Attribute a supply-chain compromise to a stage — source, build, distribution, or dependency — using a stage-gated evidence matrix and a reproducible-build diff.

لغة النص الأصلي: الإنجليزية

attacking-domains-end-to-end

End-to-end domain attack methodology -- resolve, enumerate subdomains, run DNS recon, check for subdomain takeover, scan web apps, and exploit across the full domain attack surface. Orchestrates the domain-specific MCP tools.

لغة النص الأصلي: الإنجليزية

experimental-skill-test

Placeholder for the maybe/ tier. Higher-risk or niche skills live here and are ignored unless skills.maybe_enabled is true. Replace this with a real experimental skill.

لغة النص الأصلي: الإنجليزية