Results for “csrf-tokens”

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens.

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

Deploy honeytokens and canarytokens as decoy artifacts to detect intrusions with near-zero false positives.

Implement eBPF-based runtime security observability and enforcement in Kubernetes clusters using Cilium Tetragon for kernel-level threat detection and policy enforcement.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters.

Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time using file integrity monitoring or OS-level watchdogs.

Identify and exploit SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.

Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.

Scaffolds fullstack projects (Next.js, FastAPI, MERN, Django) and analyzes code quality with security and complexity scoring.

Recovers transform chains, hidden media payloads, mobile signing paths, and local trust boundaries in CTF challenges involving crypto, encoding, steganography, APK, IPA, and mobile trust-boundary analysis.

Traces which sandbox node, proxy rule, or header-derived branch serves a live request in a CTF competition environment.

Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.