Results for “waf”

Configure ModSecurity WAF with OWASP Core Rule Set for web application logging, tune rules to reduce false positives, and analyze audit logs for attack detection.

Deliberately disables or degrades security controls to verify detection and response capabilities, including WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess.

Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.

Provides a structured 5-phase workflow for bug bounty and SRC vulnerability hunting, including 19 attack-type playbooks, 305 structured payloads, 263 WAF bypass variants, and 2,887 real HackerOne case studies.

Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.

Detect and exploit SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.

Manage AWS API Gateway for creating, publishing, and securing REST, HTTP, and WebSocket APIs using CLI commands, SAM templates, and best practices.

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

Analyze vrf operations. Use when you need to understand vrf mechanisms, evaluate protocol security, or reference on-chain concepts.

Evaluates Google Cloud workloads against the Reliability pillar of the Well-Architected Framework, providing actionable recommendations for building, deploying, and managing reliable systems.

Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.

Execute remote commands on Windows targets using WMI-based lateral movement techniques, including Impacket wmiexec.py, CrackMapExec, and native PowerShell WMI commands for red team engagements.

Federal Organizational Conflict of Interest (OCI) sweeper backed by FAR Subpart 9.5 (9.501-9.508) and the active Theseus workspace knowledge graph. USE WHEN the user asks about OCI risk on a bid, organizational conflicts, incumbent conflicts, biased ground rules, unequal access to information, impaired objectivity, or any pre-bid OCI due diligence. Pulls `company`, `incumbent`, `subcontractor`, `customer`, `program_office`, and prior-contract relationships from the workspace KG, classifies each potential conflict into one of the three FAR 9.505 classes (biased ground rules, unequal access, impaired objectivity), and emits a structured findings envelope with mitigation recommendations (firewall, NDA, recusal, novation). DO NOT USE FOR FAR clause coverage audit (use `compliance-auditor`), proposal prose (use `proposal-generator`), competitor research (use `competitive-intel`), or pricing (use `price-to-win`).

Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.

Analyze AWS GuardDuty findings, detectors, suppression rules, and member accounts with parallel execution and anti-hallucination guardrails.

Analyzes AWS Cognito user pools and identity pools, covering authentication flows, MFA status, app client configuration, password policy, Lambda triggers, and federation setup.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Provides exact payloads and bypass techniques for every PortSwigger DOM-based vulnerability lab variant, including zero-day extensions and blue team detection strategies.

Hunt Client-Side Path Traversal vulnerabilities where attacker-controlled input is concatenated into the path of a fetch() or XHR request, enabling redirection and chaining to XSS or data exfiltration.

Provides a structured deep-dive into CORS misconfiguration vulnerabilities with exact payloads for every PortSwigger lab variant, including zero-day escalation techniques and blue-team detection guidance.

Evaluates Google Cloud workloads against the Well-Architected Framework security pillar, identifies security requirements, and provides actionable recommendations for IAM, network security, data protection, and operational security.

Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).