网络安全
渗透测试、安全审计、防护加固等网络安全提示词
552 个提示词
- UART, JTAG, SWD debugging interfaces discovery - Flash chip extraction and dumping…
Hardware analysis
对物联网设备进行安全测试,覆盖固件分析、硬件接口、通信协议和云后端。
IoT Device Security Testing
- Namespace isolation effectiveness - Resource quotas and limit ranges - Network…
Multi-tenancy and isolation
- CI/CD pipeline security (Tekton, ArgoCD, Jenkins, GitHub Actions) - Image build and…
Supply chain
- Service mesh (Istio, Linkerd) mTLS coverage - Ingress controller exposure and TLS -…
Network security
- Privilege escalation paths (node to cluster) - Container escape vectors (docker.sock,…
Runtime security
- Base image vulnerabilities (Trivy, Grype, Clair, Snyk) - Secrets in images (git…
Container image security
- Individual feedback (no shaming) - Department-level statistics - Awareness training…
Reporting and remediation
- Badge cloning (RFID/NFC - iCLASS, Mifare) - Tailgating and piggybacking tests - USB…
Physical assessment (if in scope)
- Reporting rates by employees - Click rates and credential submission - Time-to-report…
Response measurement
- Phishing campaign setup (GoPhish, King Phisher, EvilGinx2) - Tracking click-through…
Execution methodology
- Email phishing scenarios (3-5 realistic lures based on recon) - Landing page clones…
Pretext development
- OSINT on employees (LinkedIn, social media, GitHub) - Organizational structure mapping…
Target reconnaissance
规划社会工程学评估,包括钓鱼邮件、电话钓鱼、物理入侵和员工安全意识测试。
Social Engineering Assessment Plan
- WPS vulnerability testing (if enabled) - Bluetooth/BLE proximity attacks -…
IoT and specialized devices
- Bypass techniques (DNS tunneling, MAC spoofing) - Tracking and privacy of users -…
Captive portal assessment
- Certificate validation bypass (PEAP/EAP-MSCHAPv2) - Credential harvesting via rogue…
Enterprise authentication
- Rogue AP detection and honeypot evaluation - Client deauthentication and capture of…
Active testing
- Encryption and cipher suite selection (CCMP vs TKIP, SAE) - Authentication mode…
Configuration review
- Third-party API integration risks - Data validation between services - Trust boundary…
Unsafe Consumption of APIs
- Staging/production environment bleed - Old API versions still accessible -…
Improper Inventory Management
- CORS misconfiguration - HTTP headers (HSTS, CSP, X-Frame-Options) - Error message…
Security Misconfiguration
- Internal service access - Cloud metadata endpoint (169.254.169.254) - Blind SSRF via…
Server Side Request Forgery (SSRF)
- Role-based access control bypass - HTTP method override abuse - Administrative…