Results for “test-app”

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

Tests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation.

Integrate AFL++ coverage-guided fuzz testing into CI/CD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C/C++ and compiled applications.

Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities.

Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap.

Conducts penetration testing of iOS and Android mobile applications following the OWASP MASTG to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls.

Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.

Scan web servers and applications for vulnerabilities, misconfigurations, and outdated software using the Nikto open-source scanner.

Documents AI-built apps with architecture, permissions, secrets, and test coverage maps to make them reviewable before shipping.

Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.

Test web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.

Defines, validates, runs, resumes, and audits repo-local multi-step automations using the `asc workflow` CLI and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Provides a structured methodology for authorized Android and iOS reverse engineering, covering static analysis, dynamic instrumentation with Frida and Objection, SSL pinning bypass, root/jailbreak detection evasion, and cryptographic key extraction.

Conduct authorized iOS application security assessments using Frida, Objection, and static analysis to evaluate app security posture against OWASP MASTG standards.

Dynamically instrument iOS apps with Frida to trace methods, extract secrets, and bypass security controls during authorized penetration testing.

已上线应用的本地证据生产就绪审计——上线前审查、合并后检查及事故后分析

Automates static analysis of Android APK/AAB files using MobSF to identify hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography for pre-deployment security assessments or CI/CD integration.

Scan a codebase, live app, or site and find the features that obviously should exist but don't — missing exports, bulk actions, search/filter, undo, history, notifications, dead-end workflows, data collected but never surfaced, backend endpoints with no UI, and half-built features that stopped partway. Produces an evidence-backed, ranked punch list (top 10 max) with a portable gap_packet JSON. Use whenever the user asks "what features are missing", "what's this app lacking", "find gaps", "run gap-scan", "feature audit", or wants proposal ammo from a prospect's app. Also use it to recheck an existing gap_packet — "what's left to do", "recheck the gaps", "what got built since" — re-verifying findings against current code and marking stale ones superseded. Flags ABSENCE only — broken code goes to code-audit, confusing flows to ux-audit, weak persuasion to conversion-audit, underexploited assets to a WWBD-style analysis. If something exists but is bad, it's not a gap — hand it off.

Test web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.

Test LLM applications for system prompt leakage using manual payloads, garak, and Promptfoo to extract embedded secrets and routing logic.

Configure TLS 1.3 on nginx, Apache, and Python applications, validate configurations with openssl and testssl.sh, and disable legacy TLS versions.

Test web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.

Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.

Identify flaws in application business logic that allow price manipulation, workflow bypass, and privilege escalation beyond what automated scanners can detect.

Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.

Tests and exploits deep link vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation.

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.

Identify and exploit insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications during authorized penetration tests.