Security · By cyberful

Design and interpret advanced content discovery with ffuf and complementary web fuzzers.

cyberful/cyberful

Build a high-fidelity network and service inventory using Nmap, Masscan, packet capture, DNS, and protocol-specific follow-up.

cyberful/cyberful

Operate Semgrep and source-oriented static analysis as a hypothesis, coverage, and regression system during advanced code audits.

cyberful/cyberful

Operate Syft, Grype, Trivy, Gitleaks, Retire.js, package-manager metadata, and build evidence for advanced software-supply-chain assessment.

cyberful/cyberful

Assess race conditions, transactional invariants, idempotency, retries, replay, rate and quota enforcement, algorithmic complexity, resource amplification, and cost abuse during authorized…

cyberful/cyberful

Test native or language object reconstruction, polymorphic type selection, gadget reachability, schema bypass, mass object binding, and unsafe serializer configuration in authorized applications or…

cyberful/cyberful

Test authorized web-cache key construction, variation, partitioning, authenticated response handling, revalidation, poisoning, deception, purge, and TTL behavior.

cyberful/cyberful

Audit local AI model, adapter, tokenizer, configuration, and packaging artifacts for provenance, integrity, dependency, serialization, license, and loading-risk evidence.

cyberful/cyberful

Test whether authorized direct or indirect untrusted content can alter an AI system's protected behavior, context use, memory, retrieval, output handling, or downstream capability.

cyberful/cyberful

Test deterministic authorization around AI tool discovery, selection, canonical arguments, credentials, tenants, destinations, approvals, delegation, retries, and effects.

cyberful/cyberful

Reconstruct how instructions, retrieved content, memory, identities, approvals, tool schemas, arguments, outputs, delegation, and fallbacks propagate through an AI system.

cyberful/cyberful

Extract bounded, deterministic evidence from crash and sanitizer logs, including signals, sanitizer classes, memory-safety indicators, stack-frame hashes, and source provenance, while reserving…

cyberful/cyberful

Normalize and compare authorized fraud-control observations from local evidence, highlighting decision drift, coverage gaps, and conflicting outcomes without making a fraud or vulnerability verdict.

cyberful/cyberful

Parse bounded classic PCAP files offline into deterministic capture metadata, packet-length and timestamp summaries, link and network protocol counts, truncation indicators, and source digests…

cyberful/cyberful

Model fraud and abuse threats across actors, account states, value flows, controls, and monetization paths.

cyberful/cyberful

Assess the security of a smart-contract system across protocol economics, trust roles, upgrade and governance paths, oracle and bridge dependencies, deployment state, and off-chain operators.

cyberful/cyberful

Audit desktop client source, binaries, packaging, updater, local storage, IPC, protocol handlers, WebViews, plugins, native bridges, credential use, and OS integration for trust-boundary failures.

cyberful/cyberful

Audit extracted embedded firmware for boot and update trust, credential and secret handling, service exposure, privilege boundaries, parsers, persistence, cryptography, hardening, recovery, and…

cyberful/cyberful

Audit security logging and telemetry from event creation through transport, storage, access, correlation, retention, and response use.

cyberful/cyberful

Test browser capability transfer across postMessage, opener, frame, portal, worker, service-worker, BroadcastChannel, MessagePort, and extension messaging boundaries.

cyberful/cyberful

Test whether every segmentation and scope-reduction control isolates the cardholder data environment from claimed out-of-scope systems and differing security levels.

cyberful/cyberful

Test payment decision and value-movement invariants with authorized synthetic instruments and reversible sandbox transactions.

cyberful/cyberful

Trace uploaded, imported, generated, archived, converted, scanned, rendered, and downloaded files across storage, naming, extraction, parser, sandbox, and cleanup boundaries.

cyberful/cyberful

Reconstruct how principal, actor, issuer, audience, assurance, scopes, and delegated authority change across requests, tokens, services, queues, and stored artifacts.

cyberful/cyberful

Reconstruct how tenant and organization context is authenticated, selected, routed, cached, queued, and bound to resources across distributed request paths.

cyberful/cyberful

Reconstruct transaction state across services, ledgers, queues, and compensations from local artifacts, identifying causal gaps, duplicate effects, and value mismatches without active traffic.

cyberful/cyberful

Build or challenge an application threat model from architecture, dataflows, identities, trust boundaries, business invariants, dependencies, and deployment context.

cyberful/cyberful

Route broad AI-agent security reviews to focused Cyberful skills across risk, model supply chain, context and capabilities, prompt injection, tool authorization, and RAG isolation.

cyberful/cyberful

Coordinate a repository-wide white-box application security audit across architecture, source, configuration, dependencies, build, and deployment paths.

cyberful/cyberful

Audit C, C++, unsafe Rust, native extensions, parsers, codecs, FFI boundaries, and systems code for memory corruption and low-level exploitation risk.

cyberful/cyberful

Coordinate an authorized software-supply-chain audit from dependency resolution through build, artifact, release, deployment, and runtime trust.

cyberful/cyberful

Operate Cyberful as an authorized application-security control room.

cyberful/cyberful

Operate Ghidra headless analysis, radare2, platform binary utilities, decompilers, and targeted dynamic evidence for advanced native and bytecode security review.

cyberful/cyberful

Operate Prowler, Cloudsplaining, cloud CLIs, policy documents, and resource evidence for advanced AWS, Azure, GCP, and Kubernetes-adjacent posture assessment.

cyberful/cyberful

Operate Cyberful's pinned Foundry toolchain and engagement-owned Anvil lab for authorized EVM smart-contract bug bounty work.

cyberful/cyberful

Operate kubectl, kube-bench, Trivy, Prowler, and manifest/runtime evidence for advanced Kubernetes security assessment.

cyberful/cyberful

Operate AFL++, libFuzzer with Clang sanitizers, and Jazzer for advanced coverage-guided native and JVM fuzzing.

cyberful/cyberful

Use sqlmap to confirm and characterize suspected SQL injection with faithful requests and bounded evidence.

cyberful/cyberful

Coordinate testing of product invariants and multi-step workflows across money, entitlements, approvals, quotas, inventory, onboarding, and distributed state.

cyberful/cyberful

Assess sensitive-data lifecycle, secret handling, cryptographic design and implementation, key management, password storage, randomness, signing, encryption, transport protection, and side channels…

cyberful/cyberful

Assess server-side URL retrieval and network egress during authorized penetration tests or code audits.

cyberful/cyberful

Test and audit authenticated session state across cookies, opaque tokens, bearer tokens, refresh tokens, devices, browsers, APIs, and privilege transitions.

cyberful/cyberful

Reconstruct request and event causality across gateways, services, queues, workers, data stores, and external providers while preserving identity, tenant, authorization, retry, and side-effect…

cyberful/cyberful

Trace and test untrusted data through SQL, NoSQL, LDAP, XPath, XML, shell, process, template, expression-language, code-evaluation, log, spreadsheet, mail, header, and browser interpreters.

cyberful/cyberful

Transform bounded HAR captures into deterministic HTTP evidence about methods, origins, paths, status classes, header presence, redirects, cookies, and body sizes without replaying traffic or…

cyberful/cyberful

Normalize and correlate bounded SARIF and Cyberful finding exports offline by rule, location, fingerprint, source, level, suppression, and evidence reference without treating scanner severity as…

cyberful/cyberful

Assess AI-system risk from architecture, intended use, affected actors, model limitations, data lineage, autonomy, human oversight, monitoring, and failure consequences.

cyberful/cyberful

Audit container runtime isolation across namespaces, capabilities, seccomp, mandatory access control, mounts, devices, daemon sockets, cgroups, identity, and host integration.

cyberful/cyberful