تشغيل أي مهارة في Manus بنقرة واحدة

security-patterns

النجوم٦

التفرعات٠

آخر تحديث٢٢ مايو ٢٠٢٦ في ١٥:٤٣

Reusable attack patterns distilled from disclosed vulnerability reports. Use when hunting for vulnerabilities to understand common exploitation chains, or when you're stuck and need to think about what typically goes wrong in a given feature type.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

JesusConwellpy

JesusConwellpy/ai-security-methodology

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

محللو أمن المعلوماتمهن الحاسوب والرياضيات·SOC 15-1212

SKILL.md

readonly

name	security-patterns
description	Reusable attack patterns distilled from disclosed vulnerability reports. Use when hunting for vulnerabilities to understand common exploitation chains, or when you're stuck and need to think about what typically goes wrong in a given feature type.
license	MIT
compatibility	Requires filesystem-based agent with read access to the patterns directory.
allowed-tools	Bash Read Glob Grep
metadata	{"user-invocable":"true","argument-hint":"<pattern-category>"}

Attack Patterns

Distilled patterns from disclosed cases. Each pattern describes: what it is, signals to look for, typical exploitation flow, and generalized examples.

Pattern Index

Category	Document	Focus
Password reset step-skip, SSO token theft, weak session keys, remember-me tokens	Auth Vulnerabilities	Authentication flaws
Direct input concatenation, NoSQL operator injection, blind SQL, second-order injection	Injection Patterns	Injection variants
Email verification bypass, unauthenticated API access, subscription manipulation, IDOR	Authorization Bypass	AuthZ bypass
Payment tampering, race conditions, password reset logic, CAPTCHA bypass, coupon abuse	Business Logic Flaws	Logic flaws
Hop-by-hop header leakage, Alt-Svc credential leak, directory/file enumeration	Information Disclosure	Info leaks
Unauthenticated endpoints, IDOR, BOLA, mass assignment, GraphQL introspection	API Vulnerabilities	API issues
Multi-step chains combining multiple low-severity issues into critical impact	Chained Attacks	Attack chains

How to Use

1. Identify the feature type you're testing (auth, API, payment, file handling)
2. Load the corresponding pattern document
3. Check each pattern against the target: "Does our target have this signal?"
4. For each matching signal, follow the exploitation flow
5. Chain low-severity findings using chained-attacks patterns

Reference Data

For vendor-specific fingerprints and default credentials (especially China-market enterprise software), load:

المزيد من هذا المستودع

نفس المستودع

security-methodology

JesusConwellpy/ai-security-methodology

Security research methodology — 5-phase workflow (intake → recon → enum → hunt → report). Routes to specialized technique modules. Use when the user asks to audit, penetration test, bug bounty, find vulnerabilities, exploit a target, or perform any security assessment.

2026-05-236

ai-ml-security

JesusConwellpy/ai-security-methodology

AI/ML attack techniques — prompt injection, indirect/RAG poisoning, tool-calling manipulation, adversarial examples, model extraction, membership inference, training data extraction. Use when the target involves LLM agents, chatbots, ML model APIs, image classifiers, or federated learning systems.

2026-05-226

binary-exploitation

JesusConwellpy/ai-security-methodology

Binary exploitation techniques — buffer overflow, format string, heap exploitation, ROP, kernel exploitation, sandbox escape, shellcode. Use when the target is a native binary (ELF/PE), remote service with memory corruption, or kernel module. Requires pwntools, GDB, and binary analysis tools.

2026-05-226

crypto-attacks

JesusConwellpy/ai-security-methodology

Cryptography attack techniques — RSA, ECC, symmetric ciphers, hash collisions, PRNG attacks, lattice/LWE. Use when the challenge involves encryption, decryption, key recovery, nonce reuse, padding oracles, or cryptanalysis of custom schemes.

2026-05-226

forensics

JesusConwellpy/ai-security-methodology

Forensic analysis techniques — disk, memory, network, steganography, side-channel analysis. Use when given a disk image (.dd, .E01, .raw), memory dump (.vmem, .raw), packet capture (.pcap, .pcapng), image/audio file with hidden data, or side-channel trace.

2026-05-226

malware-analysis

JesusConwellpy/ai-security-methodology

Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system.

2026-05-226

Attack Patterns

Distilled patterns from disclosed cases. Each pattern describes: what it is, signals to look for, typical exploitation flow, and generalized examples.

Pattern Index