Tagged vulnerabilities

Test Linux hosts for privilege escalation through SUID, capabilities and sudo

Audit TLS setups for downgrade attacks and misconfigurations like POODLE and DROWN

Research CVEs, public exploits and advisories for a component before attempting an exploit

Keep a cross-session fact graph of pentest findings, evidence and vulnerability records

Format pentest findings, vulnerability reports and change logs in a consistent structure

Scan Algorand TEAL and PyTeal contracts for rekeying and fee validation bugs

Scan Cairo and StarkNet contracts for overflow, messaging and replay bugs

Scan a codebase with CodeQL taint and data-flow analysis for vulnerabilities

Scan Cosmos SDK modules and CosmWasm contracts for consensus and fund-loss bugs

Scan Solana and Anchor programs for arbitrary CPI, PDA and signer check bugs

Scan Substrate and FRAME pallets for overflow, weight and origin check bugs

Scan TON FunC contracts for fake Jetton, gas and boolean misuse bugs

Expand one vulnerability into graph neighbors that may share the same bug

Triage vulnerability reports and CVEs to decide validity, priority and response

Adapt a sanitizer-based vulnerability pipeline to new bug classes and languages

Get oriented with the vulnerability harness and answer questions from its docs

Build a threat model from owner interviews or past vulnerabilities and code

Scan source code for vulnerabilities with parallel review subagents

Navigate vulnerability research playbooks and chain-building skill catalogs

Apply evidence-led methods for vulnerability research and evidence review

Match container runtime CVEs such as runC Leaky Vessels to a fingerprinted target

Fingerprint targets, find public CVE exploits and confirm RCE in tests

Read source code around scanner candidates to confirm real vulnerabilities

Test routers, firewalls and VPN appliances for known CVE exploit chains

Test legacy 802.11 clients for KRACK and FragAttacks key reinstallation flaws

Enumerate Linux privilege escalation paths from sudo and SUID to kernel CVEs

Find and validate vulnerability variants by diffing vulnerable and fixed code

Look up payloads, CVE PoCs and writeups from curated security references

Orchestrate a five-stage vulnerability pipeline from scan through exploit

Scan code for vulnerabilities, dangerous patterns and leaked sensitive data

Hunt authentication bypasses in SAML flows, login logic and access controls

Hunt cross-site request forgery including SameSite bypass and GraphQL via GET

Hunt DOM clobbering, postMessage, service worker and CSS injection flaws

Hunt miscellaneous web vulnerabilities drawn from 225 public bounty reports

Hunt Spring Boot Actuator exposure, SpEL injection and H2 console RCE

Hunt SQL injection including ORM raw-fragment and second-order bugs

Pull payloads, bypass tables and wordlists for web vulnerability testing

Fingerprint VMware vCenter and map its high-impact CVE attack chain

Look up CVE records, KEV entries and EPSS scores from a cached daily dataset

List the CISA known exploited vulnerabilities catalog to prioritize urgent patches

Scan project dependencies for known vulnerabilities using the Google OSV database

Run vulnerability scans for open ports, web apps and cloud compliance

Explain common web vulnerability classes and how to spot them in APIs and apps

Coordinate a supervised fleet of auditors to find and verify vulnerabilities in a target

Run OWASP checks, vulnerability scans and adversarial red team tests on code

Match discovered service versions to CVEs and rank them by CVSS and exploitability

Match recon findings to CVEs with evidence before deeper red-team testing

Validate candidate CVEs with scoped evidence before deciding to pivot or report

Guide authorized file vulnerability tests for path traversal, uploads and LFI