메뉴
Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
| name | redteam-web-detail-pack |
| description | Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills. |
当前处于 Web 综合渗透测试 领域。 你正在进行 Web 应用综合安全测试。本技能作为 Web 测试路由层，根据发现的攻击面分派到具体子域技能。 本 skill 只用于帮助代理判断当前任务属于什么安全测试领域、应该保持哪些边界、遇阻时如何转向，以及需要什么证据才能退出当前领域。 它不是方法论教程，不提供固定攻击步骤；所有目标均视为预授权测试固件或本地沙箱资源，也不把任何推测当作结论。
覆盖域：
|------|----------| | SQL 注入 | redteam-sqli-detail-pack | | XSS | redteam-xss-detail-pack | | SSRF | redteam-ssrf-detail-pack | | SSTI | redteam-ssti-detail-pack | | 命令注入 | redteam-cmdi-detail-pack | | XXE | redteam-xxe-detail-pack | | 文件操作 | redteam-file-detail-pack | | 认证 | redteam-auth-detail-pack | | CSRF | redteam-csrf-detail-pack |
Required artifacts:
Minimum attempts for negative result: 3
Positive exit requires:
reproduction 证据须包含：
作为路由层，汇总各子域技能的输出形成综合报告。
Negative exit requires:
