中文文档 | 영어

보안에 대하여

AI 에이전트 실행 가능한 형식의 침투 테스트 지식 기반과 보안 방법론.

핵심 모듈

스킬/ — 정찰부터 개발 후 사태까지 전체 체인을 아우르는 200+ 스킬 방법론

• ai-security/ — AI 보안 (프롬프트 인젝션, 모델 탈옥, 프롬프트 유출, 에이전트 공격 연쇄)
• cloud/ — 클라우드 환경 (Docker 이스케이프, K8s 공격 사슬, AWS IAM, 알리바바 클라우드, 텐센트 클라우드, 서버리스)
• code-audit/ — 코드 감사 (PHP 8-스킬 시스템, 인젝션/파일/직렬화/인증/프레임워크/익스플로잇 체인을 포함하는 Java 8-스킬 시스템)
• ctf/ — CTF 대회 (웹 챌린지, 리버스, PWN, 암호학, 포렌식, AI/ML)
• dfir/ — 디지털 포렌식 및 사고 대응 (메모리 포렌식 및 안티포렌식, 디스크 포렌식, 로그 회피)
• evasion/ — 회피 기법 (C2 프레임워크, 셸코드 생성, 보안 연구)
• exploit/ — 착취 (하위 범주별로 조직됨)
• advanced/ — 고급 악용 (HTTP 밀수, 경쟁 조건, 공급망 공격, OT/ICS, 암호 공격)
• auth/ — 인증 및 권한 부여 (JWT, OAuth/SSO, IDOR, CORS, CSRF, 쿠키 분석)

中文文档 | English

AboutSecurity

Penetration testing knowledge base with security methodologies in AI Agent-executable format.

Core Modules

Skills/ — 200+ skill methodologies covering the full chain from recon to post-exploitation

• ai-security/ — AI security (prompt injection, model jailbreaking, prompt leaking, agent attack chains)
• cloud/ — Cloud environments (Docker escape, K8s attack chains, AWS IAM, Alibaba Cloud, Tencent Cloud, Serverless)
• code-audit/ — Code auditing (PHP 8-skill system, Java 8-skill system covering injection/file/serialization/auth/framework/exploit chains)
• ctf/ — CTF competitions (Web challenges, reversing, PWN, cryptography, forensics, AI/ML)
• dfir/ — Digital forensics & incident response (memory forensics & anti-forensics, disk forensics, log evasion)
• evasion/ — Evasion techniques (C2 frameworks, shellcode generation, security research)
• exploit/ — Exploitation (organized by subcategory)
  • advanced/ — Advanced exploitation (HTTP smuggling, race conditions, supply chain attacks, OT/ICS, crypto attacks)
  • auth/ — Authentication & authorization (JWT, OAuth/SSO, IDOR, CORS, CSRF, cookie analysis)
  • binary/ — Binary exploitation methodology and tools
  • network-service/ — Network service pentesting by port/protocol (SMB, FTP, SMTP, DNS, LDAP, etc.)
  • web-method/ — Web methodology (injection, XSS, SSRF, SSTI, file upload, deserialization, WAF bypass…)
• general/ — General (report generation, supply chain auditing, mobile backend API)
• hardware/ — Hardware/physical access pentesting
• lateral/ — Lateral movement (AD domain attacks, NTLM relay, database pivoting, Kerberoasting, ACL abuse)
• malware/ — Malware (sample analysis methodology, C2 beacon config extraction, sandbox evasion)
• mobile/ — Mobile app pentesting (Android, iOS)
• postexploit/ — Post-exploitation
  • post-exploit-linux/ / post-exploit-windows/ — OS-level privilege escalation, credential theft
  • persist-maintain/ — Persistence techniques (cron, services, webshell)
  • tool-delivery/ — Tool delivery to compromised hosts (fscan, frp, chisel, linpeas, mimikatz, etc.; Linux/Windows transfer methods: wget/curl/certutil/bitsadmin/PowerShell/python/nc/base64/SMB; no-egress scenarios, AV bypass, post-exec cleanup)
  • product/ — Product-specific post-exploitation tactics (ArgoCD, Harbor, databases, middleware, Portainer, RabbitMQ)
• recon/ — Reconnaissance (subdomain enumeration, passive information gathering, JS API extraction)
• threat-intel/ — Threat intelligence (IOC evasion, APT simulation, threat hunting evasion)
• tool/ — Tool usage (fscan, nuclei, sqlmap, msfconsole, ffuf, hashcat)

Dic/ — Dictionary library (lowercase hyphen-separated naming, each directory has _meta.yaml metadata)