Навыков: 4 624. Сортировка по числу звёзд.
Apply Exa security best practices for secrets and access control. Use when securing API keys, implementing least privile...
Reviews a supplied security artifact and reports supported findings. Use when an authorized assessment needs focused dom...
Detects error handlers that leak stack traces or fail open on exception. Use when writing error handlers, exception catc...
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credent...
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat...
<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
Create Harness STO security exemptions (waivers) for vulnerabilities found by SAST, SCA, DAST, secret, container, or IaC...
Expense reporting bot. Expense validation, policy checks and finance-ready reports.
安全专家入口。用于 Codex CLI 的 $expert-security 调用。 适用于威胁建模、漏洞评估、安全代码审查、安全架构设计、DevSecOps、安全运营、事件响应、合规审计和完整安全健康评估。 触发词：安全专家、威胁建模、S...
Explain a specific code idiom, function, decorator, hook, or snippet in-place, with references to the governing conventi...
Real-World Exploit Priority (RWEP) scoring — CVSS plus KEV, PoC, AI-acceleration, blast radius, live-patch factors
Assess whether discovered vulnerabilities are actually exploitable in your application context using CVSS scoring, attac...
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-p...
Use Pacu modules for AWS privilege escalation, persistence, and backdooring.
Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege...
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative...
Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned...
Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting...
Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2se...
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing d...
Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between fro...
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipula...
Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (nume...
Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achie...
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm spe...
Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Director...
MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution...
Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to e...
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network reso...
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manu...
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penet...
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash...
The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains...
Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure messa...
Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller comprom...
Search for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSS
Comprehensive audit of Expo/React Native app API integration layer. Use when asked to: (1) Review API interactions, auth...
Implement AES-256-CBC encryption with secure key storage for Expo/React Native apps using expo-secure-store and crypto-j...
Für Internationaler Export: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Sch...
Export NIST OSCAL (Open Security Controls Assessment Language) JSON from compliance
Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers)...
Express engineering the Node way: middleware chains, async errors, validation, security headers, graceful shutdown. Use...
Guidance for Microsoft.Extensions.Compliance data classification and redaction. USE FOR: classifying sensitive data (PII...
Extract carrier invoice, shipment references, rates, accessorials, taxes, and total charges from freight bills.
Extract property, unit, tenant, lease dates, rents, deposits, and occupancy fields from rent rolls.
Trace a break between two records of the same position or cash — accounting vs custodian, fund vs prime broker, trade vs...