UnboundCompute/security-agent-skills

auditing-account-recovery-and-reset-trust

Audit password reset and account recovery flows for the trust that lets an attacker take over an account: a reset token that is guessable, long-lived, reusable, or not bound to the account it was issued for, a recovery path that verifies a weaker factor than…

原文の言語: 英語

auditing-http2-and-grpc-multiplexing-trust

Audit HTTP/2 and gRPC edges for framing and multiplexing trust that breaks when a stream is translated or reused: an h2c or HTTP/2-to-HTTP/1.1 downgrade that reintroduces request smuggling, pseudo-header and header handling that lets a stream forge its path…

原文の言語: 英語

auditing-jwt-verification-and-key-trust

Audit how a service verifies JSON Web Tokens for the classic verification bypasses: an algorithm-confusion attack where a token switches the signing algorithm so a public key is used as a symmetric secret or the algorithm is set to none, a key selected from…

原文の言語: 英語

auditing-message-broker-topic-authorization

Audit message-broker topic and queue authorization for reach a client should not have: a wildcard subscription that receives another tenant's messages, a publish permission broad enough to inject into a control or command topic, a shared broker where topic…

原文の言語: 英語

auditing-oauth-token-audience-and-scope-trust

Audit how a resource server trusts OAuth access tokens for confusion it should reject: a token minted for one audience accepted by a different service, a scope treated as coarser or finer than it is so a token reaches an operation it was not granted, a…

原文の言語: 英語

auditing-payment-callback-and-amount-integrity

Audit payment provider callbacks and settlement notifications for the trust that lets an attacker forge or alter a payment result: a callback whose signature is not verified so a spoofed success is accepted, an amount or currency taken from the callback or…

原文の言語: 英語

auditing-payment-state-machine-and-idempotency

Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent…

原文の言語: 英語

auditing-saml-and-oidc-federation-trust

Audit federated single sign-on for assertions a relying party should not trust: a SAML response whose signature is not verified over the right element so a wrapped or altered assertion passes, an OIDC ID token whose issuer, audience, or nonce is unchecked, a…

原文の言語: 英語

hunting-dns-rebinding-and-ssrf-pivots

Hunt server-side request forgery and DNS rebinding that turn a server into a proxy for the internal network: a URL or hostname a caller controls that the server fetches, a validation that checks the hostname once but connects later so a rebinding answer swaps…

原文の言語: 英語

hunting-http-request-smuggling-and-desync

Hunt for request smuggling where two HTTP processors on the same path disagree about where one request ends and the next begins: a front end and back end that resolve conflicting Content-Length and Transfer-Encoding headers differently, a proxy that forwards…

原文の言語: 英語

hunting-mutual-tls-and-service-identity-gaps

Hunt for gaps in how a service establishes and verifies the identity of the peer calling it: a mutual-TLS endpoint that requests a client certificate but does not require or verify it, verification that checks the certificate chains to a trusted authority but…

原文の言語: 英語

hunting-price-and-coupon-manipulation

Hunt for ways a buyer can control the price the server charges: a price, quantity, or line total taken from the client request instead of recomputed server-side from a trusted catalog, a negative or overflowing quantity that drives the total down or wraps it,…

原文の言語: 英語

auditing-admission-control-policy-gaps

Audit cluster admission control for gaps that let a non-compliant or hostile workload through: a validating webhook that fails open when its backend is unreachable, a policy that scopes by namespace or label and misses the namespaces that matter, a mutating…

原文の言語: 英語

auditing-container-image-provenance

Audit how a cluster decides which container images to trust and run: an image referenced by a mutable tag rather than a content digest, a workload pulling from a registry that admits unsigned or unverified images, a signature or attestation policy that is…

原文の言語: 英語

auditing-container-runtime-and-socket-exposure

Audit whether a workload can reach the container runtime and thereby control the host: the container runtime socket mounted into a pod or bound into a build or CI container, a privileged sidecar that talks to the runtime to launch or inspect containers, a…

原文の言語: 英語

auditing-host-mount-and-device-exposure

Audit the host paths and devices a workload mounts for reach across the container boundary onto the node: a writable hostPath into a sensitive node directory, a mount of the host root or a system path that exposes other pods' data and node configuration, a…

原文の言語: 英語

auditing-init-and-sidecar-injection-trust

Audit the init and sidecar containers a workload runs, including ones injected by a mutating admission webhook, for trust the main container never granted: an injected sidecar that runs with broader privileges, host access, or credentials than the workload,…

原文の言語: 英語

auditing-namespace-as-tenant-boundary

Audit a Kubernetes namespace that is treated as a tenant isolation boundary for the isolation it does not actually provide: cluster-scoped resources and nodes shared across namespaces, RBAC that grants a tenant reach beyond its own namespace, missing network…

原文の言語: 英語

auditing-network-policy-segmentation-gaps

Audit cluster network segmentation for the reachability a workload should not have: a namespace with no default-deny so every pod can reach every other pod, a missing egress policy that lets a compromised pod call out to the internet or the cloud metadata…

原文の言語: 英語

auditing-service-mesh-mtls-and-authz-trust

Audit a service mesh for the trust it claims but does not enforce: a mesh in permissive mode that accepts plaintext alongside mutual TLS so an unauthenticated caller still gets through, an authorization policy that is absent, scoped too narrowly, or defaults…

原文の言語: 英語

auditing-workload-secret-exposure-surface

Audit how a workload holds its secrets for the exposure that outlives the secret's intent: a secret passed as an environment variable that any process, crash dump, or child inherits and that debug endpoints echo, a secret volume mounted where a sidecar or a…

原文の言語: 英語

hunting-container-escape-surface

Hunt for the configuration that lets a workload break out of its container onto the node: a pod that runs privileged or adds dangerous capabilities, a host namespace shared into the container (host PID, network, or IPC), a writable host path or device mounted…

原文の言語: 英語

hunting-kubelet-and-node-api-exposure

Hunt for node-level Kubernetes endpoints that are reachable and under-authenticated: a kubelet API that allows anonymous or unauthenticated requests to list pods, read logs, or exec into containers, a read-only kubelet port exposing pod and node data, a…

原文の言語: 英語

mapping-pod-to-cloud-credential-reach

Map what cloud identity a compromised pod can reach and what that identity can then do: a pod bound to a workload identity or role far broader than it needs, a node instance role reachable from any pod through the node metadata endpoint, a service-account…

原文の言語: 英語

auditing-ansible-become-and-vault-trust

Audit configuration-management privilege escalation and secret handling for trust that runs as root on every managed host: a task that escalates with become across a whole play when only one step needs it, a role or variable sourced from an untrusted place…

原文の言語: 英語

auditing-cross-account-role-trust-boundaries

Audit cross-account IAM role assumption for trust policies that let the wrong principal assume a role: a trust policy with a wildcard or overbroad principal, a missing or unverifiable external ID on a third-party role, a confused-deputy path where a vendor…

原文の言語: 英語

auditing-ecs-task-metadata-boundaries

Audit container task credential and metadata boundaries in orchestrated compute such as ECS: a workload that can reach the container credential endpoint or the host instance metadata service to obtain a role broader than the task needs, a task role…

原文の言語: 英語

auditing-iac-module-and-provider-supply-chain

Audit the supply chain of infrastructure-as-code modules and providers for trust that runs at plan or apply time: a module sourced from an unpinned or attacker-influenceable location, a provider or plugin pulled from a registry without integrity pinning, a…

原文の言語: 英語

auditing-kms-key-policy-and-envelope-encryption

Audit key-management policies and envelope-encryption design for a decrypt path broader than intended: a key policy or grant that admits a principal who should never decrypt, a wildcard key resource in an identity policy that covers unrelated keys, an…

原文の言語: 英語

auditing-observability-pipeline-collector-trust

Audit telemetry collectors and observability pipelines for trust they should not extend: a collector endpoint that ingests metrics, logs, or traces without authenticating the sender, a processor that executes or forwards based on attacker-controllable…

原文の言語: 英語

auditing-presigned-url-scope-abuse

Audit presigned object-storage URLs for scope that grants more than the request intended: a signature that covers a broader key, prefix, or bucket than the user should reach, an overlong expiry, a method or content-type left unconstrained, or a signer…

原文の言語: 英語

auditing-s3-object-ownership-trust

Audit object-storage ownership and per-object access for trust the bucket policy does not cover: an object uploaded by another account that keeps that uploader's ownership and ACL, a bucket where object ACLs still grant access despite a restrictive bucket…

原文の言語: 英語

auditing-terraform-state-and-backend-trust

Audit infrastructure-state storage and its backend for exposure and tampering: a state file holding plaintext secrets in a backend readable by too many principals, a state bucket or backend without encryption, versioning, or access scoping, a missing or…

原文の言語: 英語

hunting-helm-template-and-values-injection

Hunt injection through Kubernetes packaging templates and their values: an untrusted value rendered into a manifest without quoting so it injects YAML structure, a value that flows into a container command, an annotation, or an RBAC rule and grants more than…

原文の言語: 英語

mapping-service-account-impersonation-chains

Map service-account impersonation and token-generation paths that let a principal act as a more-privileged identity: a role granting impersonation or token creation on a service account, an actAs or token-creator permission that chains one identity into…

原文の言語: 英語

reviewing-secrets-manager-access-policy-trust

Review who can actually read a managed secret: a secrets-manager or vault access policy that grants read to a broader principal set than the secret's consumers, a resource policy and an identity policy that combine to admit an unintended reader, a wildcard on…

原文の言語: 英語

auditing-datastore-exposure-and-abuse

Audit in-memory and cache datastores such as Redis and memcached for exposure and command abuse: an instance reachable without authentication, a request that composes datastore commands from untrusted input, or server-side scripting and module or config…

原文の言語: 英語

hunting-blind-and-second-order-sql-injection

Hunt the SQL injection that first-order testing misses: blind injection where the response carries no error or data and the signal is a boolean difference or a timing delay, and second-order injection where input is stored safely on one request and later…

原文の言語: 英語

hunting-connection-string-and-jdbc-url-injection

Hunt injection into database connection strings and JDBC or driver URLs where untrusted input sets the host, a driver property, or a URL parameter, turning a data connection into a request to an attacker server or an unsafe driver feature. Covers a tenant,…

原文の言語: 英語

hunting-dotnet-deserialization-type-injection

Hunt .NET deserialization where untrusted input reaches a formatter that resolves the type from the data itself: BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter or ObjectStateFormatter on ViewState, or Json.NET and similar with…

原文の言語: 英語