wgpsec/AboutSecurity

wgpsec/AboutSecurity

Skill Claude CodeCodex

A playbook for moving from Google Cloud Platform (GCP) into Google Workspace, the suite containing services such as Gmail, Drive, Calendar, and administration tools.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A playbook for penetration testing Huawei Cloud, including its identity, virtual-machine, storage, database, container, function, and logging services.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A playbook for attacking Kubernetes, a system that manages groups of containers across machines. It focuses on escaping containers and taking control of cluster components or nodes.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A playbook for testing IngressNightmare, a Kubernetes Ingress-NGINX admission-controller vulnerability that can allow unauthorised remote code execution under specific conditions.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing Istio security controls in Kubernetes. Istio is a service mesh that manages traffic between services, while Envoy is the proxy often placed beside each application container.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to discovering services and networks from inside a Kubernetes cluster after access to a container has been obtained. It includes Kubernetes-aware and DNS-based discovery methods.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing sidecar containers in Kubernetes. A sidecar is an additional container in the same Pod, often used to proxy network traffic for the main application.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing shared storage mounted inside Kubernetes containers, such as NFS, EFS, persistent volumes, ConfigMaps, and Secrets.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing Kubernetes admission webhooks and policy engines. These components inspect or modify requests before Kubernetes accepts them; examples include Kyverno, OPA Gatekeeper, and custom webhooks.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to assessing misconfigured cloud object-storage buckets, including AWS S3, Alibaba OSS, Tencent COS, and Huawei OBS. These services store files and other objects in remotely accessible buckets.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to security testing for serverless functions, which are cloud-hosted programs that run in response to events without a continuously running server. It covers services such as AWS Lambda, Tencent Cloud SCF, Alibaba Cloud FC, and Azure Functions.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to penetration testing Tencent Cloud environments. Tencent Cloud provides services such as object storage, virtual machines, databases, containers, serverless functions, load balancers, logs, and key management.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A structured method for auditing Java source code for security problems. It follows the path from routes and permissions through data flows, vulnerability checks, and possible exploit chains, requiring evidence for each finding.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A guide to auditing authentication and security settings in Java source code. It covers access controls, tokens, encryption, information exposure, and business-process flaws.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A method for joining separate Java security findings into one possible attack path. It also assesses whether known CVEs in Maven or Gradle dependencies are actually reachable and exploitable in the project.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A Java source-code security audit for finding unsafe file operations.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A Java source-code audit for security problems in common frameworks and libraries.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A Java source-code audit for security problems in browser-facing output, requests, redirects, headers, cookies, and sessions. It covers XSS, CSRF, open redirects, CRLF injection, and session-management flaws.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A Java source-code audit for injection flaws, where untrusted input is interpreted as a database query, command, network request, directory query, expression, or document query. It covers SQL, command, SSRF, LDAP, SpEL or OGNL, and NoSQL injection.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A Java source-code security audit for risks in serialization, XML parsing, and template engines. It checks native deserialization, XXE (when unsafe XML processing reads external entities), and template injection that can lead to code execution.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A structured method for auditing PHP source code for security vulnerabilities. It moves through route mapping, permission modeling, data-flow tracing, category-specific checks, and attack-chain analysis.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A PHP source-code audit for authentication, authorization, security configuration, cryptography, and business logic. It covers credential and token weaknesses, access-control errors, unsafe settings, weak cryptography, and logic flaws.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A method for evaluating whether multiple PHP security flaws can be combined into a complete attack path. It also includes scanning Composer packages for known dependency vulnerabilities.

wgpsec/AboutSecurity

Skill Claude CodeCodex

A PHP source-code audit for unsafe file and archive operations. It covers uploads, reads, writes, race conditions, symbolic links, and archive extraction.