Menu
渗透速查与Payload — 快速Payload家族、绕过提醒、验证顺序、常见测试卡片，适用于已知测试方向后快速查找
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
| name | rapid-checklist |
| description | 渗透速查与Payload — 快速Payload家族、绕过提醒、验证顺序、常见测试卡片，适用于已知测试方向后快速查找 |
仅在路由已明确后使用。本 Skill 用于快速查找，不替代方法论或工作流选择。
pentest-flowclient-reverseCTF 题目优先用
ctf-web/ctf-crypto/ctf-miscSkill，以下为快速卡片：
| 场景 | 快速定位 |
|---|---|
| PHP 弱比较 → 0e 开头 MD5 值 | ctf-web → php-bypass-cheatsheet.md |
| 命令注入空格绕过 → ${IFS}/$IFS$9/< | ctf-web → command-injection-bypass.md |
| eval 无回显 → 写文件/DNS 外带 | ctf-web → eval-and-rce-techniques.md |
| RSA 小指数 → 立方根/Coppersmith | ctf-crypto → rsa-attacks-cheatsheet.md |
Python Jail → __import__/func_globals | ctf-misc → python-jail-escape.md |
| 编码链 → base64→hex→ROT13 多层 | ctf-misc → encoding-chain-reference.md |
', ", ), 布尔差异, 时间差异, 报错差异<script>, <img onerror>, javascript:, DOM sink;id, |id, `id`, $(id){{7*7}}, ${7*7}, <%= 7*7 %>, 模板引擎指纹<!ENTITY>, 参数实体, OOB 外带client-reverse 稳定重放client-reverse runtime-first 路径intranet-pentest-advancedpentest-toolsreferences/08-rapid-checklists-and-payloads.md — 速查与 Payload 整合参考references/testing-methodology.md — 测试方法论