UnboundCompute/security-agent-skills - 2ページ

hunting-expression-language-injection

Hunt expression-language injection where untrusted input reaches a server-side expression evaluator: Spring Expression Language, OGNL, MVEL, JEXL, a Jakarta or JSP EL context, or a rules engine that evaluates strings. Covers request data flowing into an…

原文の言語: 英語

hunting-java-deserialization-gadget-chains

Hunt Java deserialization that turns an untrusted byte stream into code execution: attacker-controlled data reaching readObject, an ObjectInputStream, or a framework endpoint that deserializes, with a gadget on the classpath whose readObject or finalizer…

原文の言語: 英語

hunting-ldap-injection-and-bind-trust

Hunt LDAP injection and bind-trust flaws where untrusted input reaches a directory query or an authentication bind: a request value spliced into a search filter or a distinguished name without escaping, letting the caller alter the filter logic or the search…

原文の言語: 英語

hunting-nosql-operator-and-where-injection

Hunt NoSQL injection where untrusted input becomes query structure rather than a bound value: a request body whose keys turn into query operators, a value that arrives as an object instead of a scalar, or input reaching a server-side JavaScript evaluation…

原文の言語: 英語

hunting-php-object-injection-pop-chains

Hunt PHP object injection where untrusted input reaches unserialize or a framework unserializer and a reachable class carries a magic method that fires during or after reconstruction. Covers native unserialize on request data, cookies, or cache entries, phar…

原文の言語: 英語

hunting-python-unsafe-deserialization

Hunt Python deserialization that executes attacker code: untrusted input reaching pickle.loads, an unsafe YAML load, marshal, jsonpickle, dill, or a numpy or pandas loader that unpickles, where the format supports arbitrary object construction through…

原文の言語: 英語

hunting-search-engine-injection

Hunt injection into search and analytics engines such as Elasticsearch, OpenSearch, and Solr where untrusted input reaches a query DSL body, a query-string or Lucene query, a script field, or a stored scripting expression. Covers request data that becomes…

原文の言語: 英語

hunting-server-side-prototype-pollution

Hunt server-side prototype pollution in JavaScript and TypeScript backends where untrusted input sets a __proto__, constructor, or prototype key through a recursive merge, a deep clone, a path-based set, or a query or body parser, polluting Object.prototype…

原文の言語: 英語

auditing-browser-extension-trust

Audit a browser extension (Manifest V3) for a trust boundary another web page or extension can cross to reach a privileged capability, after the permission scope and the message-sender checks are resolved. Covers an externally_connectable or onMessageExternal…

原文の言語: 英語

auditing-editor-extension-workspace-trust

Audit an editor or IDE extension for actions it runs on untrusted workspace contents, after the workspace-trust capability and activation events are resolved. Covers a task, debug preLaunchTask, or command that auto-runs on folder open, a tool path or command…

原文の言語: 英語

auditing-electron-ipc-trust

Audit an Electron desktop app for untrusted renderer content that reaches a Node or operating-system capability, after the webPreferences and the preload bridge surface are resolved. Covers nodeIntegration enabled with contextIsolation off, a preload that…

原文の言語: 英語

auditing-file-upload-and-content-handling

Audit a file-upload and content-handling path for an attacker-supplied file whose bytes, declared type, name, or embedded content reach a sink that stores it in a served or executable location or feeds it to a parser that acts on its content, after the…

原文の言語: 英語

auditing-grpc-service-authorization

Audit a gRPC service for a method a caller can reach without the authorization the service assumes an interceptor enforces, after the interceptor coverage and the channel credentials are resolved. Covers authorization installed on the unary interceptor while…

原文の言語: 英語

auditing-jwt-verification-trust

Audit code that verifies a JSON Web Token for a signature or claims check that trusts token-supplied parameters, so an attacker can forge a token the server accepts, after the algorithm pinning and the key source are resolved. Covers an algorithm taken from…

原文の言語: 英語

auditing-move-resource-ownership

Audit a Move smart contract (Aptos or Sui) for a public entry function or a passed object or resource that acts without verifying signer authority, ownership, or capability possession, after the function visibility and the ability set are resolved. Covers a…

原文の言語: 英語

auditing-websocket-connection-trust

Audit a WebSocket endpoint for trust established once at the handshake and never re-checked, so a cross-site page or a post-handshake message drives a privileged action, after the origin check and the credential source are resolved. Covers a missing or…

原文の言語: 英語

hunting-cicd-workflow-injection

Hunt a CI/CD pipeline for attacker-controlled repository data that reaches a privileged execution context, after the trigger and the token scope are resolved. Covers an untrusted event field (an issue or pull-request title, a branch name, a commit message)…

原文の言語: 英語

auditing-android-component-exposure

Audit an Android app for components another app on the device can reach and drive, after the manifest export flags and permission gates are resolved. Covers an activity, service, broadcast receiver, or content provider exported without a permission gate, an…

原文の言語: 英語

auditing-container-image-build-hardening

Audit container image build definitions (Dockerfile, containerfile, and the compose or run config that sets runtime flags) for an image that ships over-privileged or carrying a secret, after multi-stage discards and deploy-time overrides are accounted for.…

原文の言語: 英語

auditing-infrastructure-as-code-exposures

Audit existing infrastructure-as-code definitions (Terraform, OpenTofu, CloudFormation, Bicep, Pulumi) for resource state that would provision an insecure resource, after variables, modules, and account defaults are resolved. Covers storage exposed to the…

原文の言語: 英語

auditing-kubernetes-workload-and-rbac-hardening

Audit Kubernetes manifests for a subject granted more than it needs or a workload that can escape its container, after the binding graph and admission policy are resolved. Covers a RoleBinding or ClusterRoleBinding to cluster-admin or a wildcard-verb role, a…

原文の言語: 英語

auditing-mobile-deeplink-trust

Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain…

原文の言語: 英語

auditing-session-lifecycle-and-fixation

Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the…

原文の言語: 英語

auditing-smart-contract-access-control

Audit a smart contract for a privileged action any caller can reach, so an attacker invokes a function that should be restricted. Covers a state-changing or fund-moving function missing an authorization modifier, an ownership or role check that is wrong or…

原文の言語: 英語

auditing-tls-and-certificate-validation

Audit client code for transport security that is disabled or defeated, so an attacker on the network path can intercept a connection the client believes is protected. Covers verification switched off (a trust-all setting, a permissive flag, an environment…

原文の言語: 英語

hunting-defi-economic-and-oracle-flaws

Hunt a decentralized-finance protocol for a way to profit by moving a price or breaking an economic invariant, rather than by defeating an access check or re-entering. Covers a price read from a spot source an attacker can move within a transaction, a…

原文の言語: 英語

hunting-mobile-secret-and-storage-exposure

Hunt a mobile app for a real credential shipped in the binary or written to storage another party can read, scoped strictly to mobile-specific sinks. Covers a live secret embedded in the app package or its resources, sensitive data written to…

原文の言語: 英語

hunting-smart-contract-reentrancy

Hunt a smart contract for state that is mutated after an external call, so an attacker re-enters before the update lands and acts on stale state. Covers a withdrawal or transfer that sends value before zeroing the balance, a call to an attacker-controlled…

原文の言語: 英語

hunting-subdomain-takeover-and-dangling-dns

Hunt DNS records that point at infrastructure the organization no longer controls, so an attacker can claim the target and serve content under a trusted name. Covers a CNAME or ALIAS to a decommissioned platform host that the provider lets anyone re-register,…

原文の言語: 英語

auditing-cors-and-cross-origin-trust

Audit the code and configuration that decide cross-origin access, for trust a browser turns into a read of authenticated data. Covers a response that reflects an arbitrary request origin into the allow-origin header alongside allow-credentials, an allowlist…

原文の言語: 英語

auditing-device-code-and-pkce-flows

Audit the server side of the authorization-code-with-proof-key and device-authorization grants for bugs that let a stolen or guessed code become a token. Covers a token endpoint that issues without checking the proof-key verifier at all, that accepts the…

原文の言語: 英語

auditing-multi-tenant-isolation

Audit whether every data operation is scoped to the caller's tenant, so a request in one tenant cannot read or write another's data. Covers a query or object lookup with the object identifier but no tenant predicate, a tenant taken from client-controlled…

原文の言語: 英語

auditing-randomness-and-nonce-quality

Audit security-sensitive values for weak randomness: a non-cryptographic generator, a predictable or constant seed, a reused nonce or initialization vector, or an output too short to resist guessing, feeding a value whose only defense is unpredictability.…

原文の言語: 英語

auditing-secure-boot-and-firmware-signing

Audit updater and bootloader code for a firmware trust boundary that lets an unsigned or downgraded image be flashed or booted. Covers an update image that reaches a flash write or a boot jump with no signature check between receipt and commit, a verification…

原文の言語: 英語

auditing-webauthn-and-passkey-flows

Audit the server side of passwordless authentication for ceremony-verification bugs that let an attacker-shaped response become an authenticated session. Covers a registration or authentication ceremony whose challenge is not bound to a server-issued…

原文の言語: 英語

auditing-webhook-authenticity-and-callback-trust

Audit both directions of webhook trust: an inbound handler that acts on a payload without proving it authentic, and an outbound fetch of a caller-supplied URL that reaches internal targets. Covers inbound handlers with no signature check, a signature compared…

原文の言語: 英語

hunting-firmware-secrets-and-debug-interfaces

Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a…

原文の言語: 英語

reviewing-content-security-policy

Review a content security policy as a script-injection defense and judge whether it would actually stop injected script, with the discipline that a weak policy is a real finding mainly where an injection sink it would otherwise block exists. Covers a script…

原文の言語: 英語

reviewing-rate-limiting-and-abuse-controls

Review whether sensitive and expensive endpoints are rate-limited and whether the limit can be bypassed, as a coverage-and-keying problem rather than a taint flow. Covers a login, credential-reset, one-time-code verify, signup, token, payment, or…

原文の言語: 英語

auditing-security-logging-completeness

Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change,…

原文の言語: 英語