Results for “oidc”

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Secure Quarkus applications with authentication, authorization, input validation, and secrets management.

Secure Quarkus applications with authentication, authorization, input validation, and secrets management best practices.

Configure and manage Harbor container registry with security features including vulnerability scanning, image signing, RBAC, content trust, and audit logging.

Federal Organizational Conflict of Interest (OCI) sweeper backed by FAR Subpart 9.5 (9.501-9.508) and the active Theseus workspace knowledge graph. USE WHEN the user asks about OCI risk on a bid, organizational conflicts, incumbent conflicts, biased ground rules, unequal access to information, impaired objectivity, or any pre-bid OCI due diligence. Pulls `company`, `incumbent`, `subcontractor`, `customer`, `program_office`, and prior-contract relationships from the workspace KG, classifies each potential conflict into one of the three FAR 9.505 classes (biased ground rules, unequal access, impaired objectivity), and emits a structured findings envelope with mitigation recommendations (firewall, NDA, recusal, novation). DO NOT USE FOR FAR clause coverage audit (use `compliance-auditor`), proposal prose (use `proposal-generator`), competitor research (use `competitive-intel`), or pricing (use `price-to-win`).

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

Diagnose and root-cause issues with OCI Kubernetes Engine clusters and workloads through evidence-driven investigation.

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing.

Build an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources.

Conduct comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths, addressing the Purdue Reference Model layers and identifying IT/OT convergence risks.

Develop and implement OT-specific incident response playbooks aligned with SANS PICERL framework, IEC 62443, and NIST SP 800-82 that address unique ICS challenges including safety-critical systems, limited downtime tolerance, and coordination between IT SOC, OT engineering, and plant operations teams.

Implements OAuth 2.0/2.1 authorization flows in Fastify applications, including authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints.

Analyze malicious software to extract actionable indicators of compromise including file hashes, network indicators, registry modifications, and embedded strings, formatted as STIX 2.1 indicators.

Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns and attribute them to common threat actors.

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators, host artifacts, and behavioral patterns for threat intelligence sharing and detection rule creation.

Authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass.

Identify and exploit OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during authorized security assessments.

Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.

Configure and deploy HashiCorp Boundary for identity-aware zero trust infrastructure access with dynamic credential brokering, session recording, and Vault integration.

Store and retrieve API keys, passwords, and credentials in an HSM-backed encrypted vault via MCP or REST API, with policy-based access control, secret rotation, multi-chain signing, and prompt injection scanning.

Signs and verifies software artifacts using Sigstore's keyless signing, Rekor transparency log, and Fulcio certificate authority, integrating into CI/CD pipelines and Kubernetes admission controls.

Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.