Results for “test”

Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.

Review pull requests following Sentry engineering practices, covering security, performance, testing, and design.

Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws.

Coordinates five specialized coding agents (linter, perf, refactor, security, test) to enforce quality gates across the development lifecycle, from lint enforcement through performance profiling, refactoring, security auditing, and test coverage.

Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities by manipulating object identifiers to detect missing per-object authorization checks.

Validate cryptographic implementations against known attacks and edge cases using Wycheproof test vectors.

Automates stateful REST API fuzzing using Microsoft RESTler to discover security and reliability bugs by compiling OpenAPI specs, configuring authentication, and running test, fuzz-lean, and full fuzzing modes.

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.

Tests API endpoints for mass assignment vulnerabilities by injecting privileged fields (role, isAdmin, balance) into request bodies and verifying if the server binds them without filtering.

Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.

Detect timing side channels in cryptographic code using formal, symbolic, dynamic, and statistical testing tools.

Use Pacu modules for AWS privilege escalation, persistence, and backdooring during authorized penetration tests.

Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite.

Guides fuzzers with domain-specific tokens to reach deeper code paths in parsers, protocol handlers, and file format processors.

Test JWT signature verification bypass by crafting tokens with the 'none' algorithm.

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or obje...

Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation.

Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage.

Reviews pull request diffs for correctness, security, maintainability, and test coverage, providing severity-ranked findings and a close-out recommendation.

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8). Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding". Proactively suggest after shipping a developer-facing feature. (gstack) Voice triggers (speech-to-text aliases): "dx audit", "test the developer experience", "try the onboarding", "developer experience test".

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns with proper testing and validation.

Detect and exploit SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

Documents AI-built apps with architecture, permissions, secrets, and test coverage maps to make them reviewable before shipping.

Extracts GraphQL API schemas through introspection attacks, identifies sensitive fields and mutations, and tests for query depth and complexity vulnerabilities.

Tests APIs for injection vulnerabilities including SQL, NoSQL, OS command, LDAP, and SSRF through parameters, headers, and request bodies.

Analyze WSDL definitions and test SOAP endpoints for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.

Runs a comprehensive verification pipeline for Django projects including migrations, linting, tests with coverage, security scans, and deployment readiness checks before PRs or releases.

Identify and exploit Insecure Direct Object Reference vulnerabilities during authorized penetration tests by manipulating object identifiers in API requests and URLs.

Test web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.

Assess GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.

Identify and test IAM misconfigurations that allow privilege escalation in AWS environments using Pacu, CloudFox, Principal Mapper, and manual analysis.

Generates custom Semgrep rules from natural language descriptions of vulnerability patterns, verifying syntax with semgrep --validate and testing against sample fixtures with semgrep --test.

Conducts comprehensive network penetration tests against authorized target environments using host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation following PTES methodology.