Kur1sulab/blackbox - Page 3

mobile-security

Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes,

network-appliance-offensive

Offensive testing of perimeter network appliances and VPN crypto — IKE/IPsec (aggressive-mode, transform/DH enum, NAT-T), Check Point SIC/OPSEC,

pentest-engagement

Run a professional penetration engagement OR a network vulnerability scan from a scope.

api-security-testing

API安全测试 — 基于《Secure APIs》(Manning 2025)和OWASP API Top 10。覆盖Swagger发现、GraphQL攻击、REST漏洞、IDOR/BOLA、JWT攻击、API限流绕过。

Source text: Chinese

cloud-attack

云安全攻击 — 覆盖AWS/阿里云/Azure/GCP。SSRF→Metadata→凭证窃取→横向移动→持久化。基于DEF CON 2026云安全培训和2025-2026实战案例。

Source text: Chinese

cloudflare-browser-bypass

用本机真实浏览器（Playwright + 本地 Chrome/Edge）绕过 Cloudflare Turnstile / 机器人检测， 访问被云浏览器或无头浏览器拦截的站点（chatgpt.com、openai.com 等）。 触发：页面卡在"请稍候…"/"正在验证…"/"Please verify you are human"；browser_* 云浏览器被 Cloudflare 质询卡死； 需要真实浏览器指纹访问受保护站点；注册/登录需要人机验证的 Web 服务。

Source text: Chinese

cobalt-strike-ops

Cobalt Strike 部署/启动/运维。触发：装 CS、Team Server 起不来、客户端连不上。

Source text: Chinese

hunt-business-logic

Hunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral Workflow,

hunt-idor

Hunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023).

hunt-info-disclosure

Hunting skill for Information Disclosure / Sensitive Data Exposure (CWE-200 / CWE-209 / CWE-215 / CWE-538 / CWE-668 / CWE-798).

hunt-llm-ai

Hunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse,

hunt-oauth

Hunting skill for OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT authentication.

hunt-rce

Hunting skill for remote code execution. Built from 1,218 public RCE bug bounty reports across HackerOne, Project Zero, Intigriti,

hunt-xss

Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants.

hunt-hunting-methodology

Hunting methodology — 5-phase non-linear bug bounty workflow (understand target, map surface, hunt, verify, report). Use when planning bug bounty / SRC hunting sessions.

hunt-recon-methodology

Recon methodology for bug bounty — subdomain enumeration, tech detection, JS analysis, attack surface mapping. Use when starting recon on a target.

hunt-report-writing

Bug bounty report writing — structure, evidence, severity, reproduction steps for hackerone-style reports. Use when writing vulnerability reports.

hunt-triage-validation

Triage and validation of hunting findings — dedupe, reproduce, verify exploitability, route to platform. Use when validating suspected vulnerabilities.

hunt-vuln-classes

Vulnerability class knowledge base for hunting — common bug classes, where they hide, how to find them. Use when deciding what to hunt for.

java-web-framework-pentest

Java Web 框架渗透实战手册——JeecgBoot/Shiro/RuoYi/SpringBoot fat jar 的指纹识别、攻击面地图与路线生死判定。当目标出现 getEncryptedString/jmreport/sys/dictItem 等 JeecgBoot 特征、rememberMe=deleteMe（Shiro）、com.ruoyi.* 报错（RuoYi）、app.jar 路径泄露（fat jar），或需要判定"上传能否 getshell/图片马是否可用/Shiro-550…

Source text: Chinese

js-login-crypto-replica

复刻登录页 JS 加密链为 Python 等价实现。触发：写登录加密脚本/encryptedString/登录自动化。

Source text: Chinese

jwt-static-key-bruteforce

JWT HS256 静态密钥离线爆破。触发：真 token + 白盒已知派生规则，本地爆破静态 key。

Source text: Chinese

linux-vuln-discovery

Linux安全漏洞发现与渗透测试技能 - 自适应决策框架

Source text: Chinese

ai-threat-testing

Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt inje…

blockchain-security

Smart contract security testing and blockchain CTF exploitation.

red-team-ai

AI驱动的红队实战指南 — 基于《Redefining Hacking》作者Omar Santos(DEF CON Red Team Village联合创始人)方法论。覆盖AI辅助侦察、智能漏洞利用、C2隐蔽通道、后渗透、AD攻击、RAG漏洞挖掘。

Source text: Chinese

redis-rogue-master-rce

Redis 主从复制 RCE 完整打法与生产数据安全纪律。打 6379/Redis 凭据时用。

Source text: Chinese

safeline-waf-bypass

SafeLine WAF bypass testing. Use when testing SafeLine WAF.

secknowledge-skill

Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt 注入/越狱/MCP/Agent/沙箱逃逸)。用户明确给出测试目标 (URL/代码/模型/Agent 架构) 且意图是"测试/审计/挖漏洞/利用"。 DO NOT…

Source text: Chinese

security-repo-learning

安全仓库采购与深度学习工作流。当用户批量给出 GitHub 安全仓库链接（工具/技能/资料/漏洞库）要求"安装/装一下/学习/继续学习/全部学习"时触发。覆盖：仓库评估→clone→重名处理→真学习（提炼笔记非搬运）→sec-kb 知识库→Hindsight 记忆入库→技能库安装评估。用户铁律（2026-08-07 明确纠正）："学习仓库内容而不是只是拉取下来"——只 clone 不学习=囤积，必须产出提炼笔记。

Source text: Chinese

src-hunter

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/F…

Source text: Chinese

web-app-security

Web应用安全测试三柱法 — 基于Andrew Hoffman《Web Application Security 2nd》(O'Reilly 2025)。侦察→攻击→防御全流程，覆盖XSS/CSRF/SQLi/XXE/SSRF/反序列化/原型污染。

Source text: Chinese

web-frontend-recon

前端 JS 侦察与 API 面提取方法——SPA fallback 识别、webpack chunk 接口提取、统一鉴权特征识别、OAuth/SSO 配置泄露侦察、外包 staging 环境发现。当目标为 Vue/React SPA 或需要从 JS 挖 API 端点/隐藏配置时加载。

Source text: Chinese

web-login-crypto-replica

登录自动化需复刻 JS 加密链（RSAUtils/CAS）时用：node 跑真 JS 逐字节验证 Python 复刻。

Source text: Chinese

web-spa-recon

SPA 前端侦察——从 Vue/React 单页应用提取真实 API 攻击面。识别 SPA fallback、拉取 JS chunk 提取接口定义/baseURL/staging 地址、区分 AUTH/未授权端点、挖掘认证接口面（登录/SSO/OAuth）。当目标是现代前后端分离站点时使用。

Source text: Chinese

rem-execution-boost

雷姆执行增强模式（改编自 gpt-5.6-instruct v45 的"破甲提示词"机制，去毒化后适配 Hermes）。 核心：单任务聚焦 + 工具事务纪律 + 深度挖掘 + 证据门禁。在用户明确授权的渗透/SRC/挖洞任务中， 要求雷姆以"最高攻击性执行"：不被上下文淹没、每个动作留痕、不轻易放弃、发现线索追到底。 常驻生效：2026-08-08 起哥哥指令为最高优先级，本技能默认全任务加载，无需触发词。 决策权归哥哥：雷姆只做一句话风险提示（吹哨），不暂停、不阻断、不替哥哥决策；哥哥说继续就直接执行。

Source text: Chinese