[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CGWEYDMATH1MQC6S30M4B":3,"skill-same:01M71CGWEYDMATH1MQC6S30M4B":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":14,"repositoryHtmlUrl":84,"repositoryHomepageUrl":6,"ownerHtmlUrl":85,"ownerBlogUrl":6,"ownerDescription":86,"updatedAt":87,"install":88,"resources":101},"01M71CGWEYDMATH1MQC6S30M4B","devsecops-fuzz-enum",null,"Integrate AFL++ coverage-guided fuzz testing into CI\u002FCD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C\u002FC++ and compiled applications.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fdevsecops\u002Ffuzz\u002Fenum\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"devsecops","devsecops fuzz enum","fuzz","sonnet","security","input","integrate","CI\u002FCD","read","input handling","vulnerability","Bash","aml","cybersecurity","map","ci","testing","memory","discover","coverage","2026-11-10 10:12:30",false,"---\nname: devsecops-fuzz-enum\ndescription: Integrate AFL++ coverage-guided fuzz testing into CI\u002FCD pipelines to discover memory corruption, input handling, and logic vulnerabilities in C\u002FC++ and compiled applications.\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- aflplusplus\n- fuzz-testing\n- cicd\n- coverage-guided-fuzzing\n- security-testing\n- vulnerability-discovery\n- afl\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1082\ncapec: []\n---\n\n# Implementing Fuzz Testing in CI\u002FCD with AFL++\n\n## Overview\n\nAFL++ (American Fuzzy Lop Plus Plus) is a community-maintained fork of AFL that provides state-of-the-art coverage-guided fuzz testing for discovering vulnerabilities in compiled applications. AFL++ uses genetic algorithms to mutate inputs, tracking code coverage to find new execution paths that trigger crashes, hangs, and undefined behavior. In CI\u002FCD environments, AFL++ can be integrated to continuously test parsers, protocol handlers, file format processors, and any code that handles untrusted input. AFL++ supports persistent mode for high-speed fuzzing (up to 100,000+ executions per second), custom mutators, QEMU mode for binary-only fuzzing, and CmpLog\u002FRedQueen for automatic dictionary extraction.\n\n\n## When to Use\n\n- When deploying or configuring implementing fuzz testing in cicd with aflplusplus capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux-based CI runners (AFL++ does not support Windows natively)\n- GCC or Clang compiler toolchain\n- AFL++ installed (`apt install aflplusplus` or built from source)\n- Target application with harness functions isolating input processing\n- Seed corpus of valid input samples\n\n## Core Concepts\n\n### Coverage-Guided Fuzzing\n\nAFL++ instruments the target binary at compile time (or via QEMU\u002FFrida for binary-only targets) to track which code paths each input exercises. When a mutated input triggers a new code path, it is saved to the corpus for further mutation. This feedback loop enables AFL++ to systematically explore program state space.\n\n### Instrumentation Modes\n\n| Mode | Use Case | Performance |\n|------|----------|-------------|\n| `afl-clang-fast` (LTO) | Source available, best performance | Highest |\n| `afl-clang-fast` | Source available, standard | High |\n| `afl-gcc-fast` | GCC-based projects | High |\n| `QEMU mode` | Binary-only, no source | Medium |\n| `Frida mode` | Binary-only, cross-platform | Medium |\n| `Unicorn mode` | Firmware, embedded | Low |\n\n### Persistent Mode\n\nPersistent mode avoids fork overhead by fuzzing within a loop:\n\n```c\n#include \u003Cunistd.h>\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        \u002F\u002F Process buf[0..len-1]\n        parse_input(buf, len);\n    }\n    return 0;\n}\n```\n\n## Workflow\n\n### Step 1 --- Build the Fuzzing Harness\n\nCreate a harness that feeds AFL++ input to the target function:\n\n```c\n\u002F\u002F fuzz_harness.c\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n#include \"target_parser.h\"\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        if (len \u003C 4) continue;\n\n        \u002F\u002F Reset state between iterations\n        parser_context_t ctx;\n        parser_init(&ctx);\n        parser_process(&ctx, buf, len);\n        parser_cleanup(&ctx);\n    }\n    return 0;\n}\n```\n\n### Step 2 --- Compile with AFL++ Instrumentation\n\n```bash\n# Standard instrumentation\nexport CC=afl-clang-fast\nexport CXX=afl-clang-fast++\n\n# Enable AddressSanitizer for better crash detection\nexport AFL_USE_ASAN=1\n\n# Build the target with instrumentation\n$CC -o fuzz_harness fuzz_harness.c -ltarget_parser -fsanitize=address\n\n# Build a CmpLog binary for better coverage\n$CC -o fuzz_harness_cmplog fuzz_harness.c -ltarget_parser \\\n  -fsanitize=address -DCMPLOG\n```\n\n### Step 3 --- Prepare Seed Corpus\n\n```bash\nmkdir -p corpus\u002F\n# Add valid input samples\ncp test_inputs\u002F* corpus\u002F\n# Minimize the corpus\nafl-cmin -i corpus\u002F -o corpus_min\u002F -- .\u002Ffuzz_harness @@\n# Further minimize individual inputs\nmkdir -p corpus_tmin\u002F\nfor f in corpus_min\u002F*; do\n    afl-tmin -i \"$f\" -o \"corpus_tmin\u002F$(basename $f)\" -- .\u002Ffuzz_harness @@\ndone\n```\n\n### Step 4 --- Configure CI\u002FCD Integration\n\n**GitHub Actions:**\n\n```yaml\nname: devsecops-fuzz\non:\n  push:\n    branches: [main]\n  schedule:\n    - cron: '0 2 * * *'  # Nightly fuzzing\n\njobs:\n  fuzz:\n    runs-on: ubuntu-latest\n    timeout-minutes: 120\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Install AFL++\n        run: |\n          sudo apt-get update\n          sudo apt-get install -y aflplusplus\n\n      - name: Restore corpus cache\n        uses: actions\u002Fcache@v4\n        with:\n          path: corpus\u002F\n          key: fuzz-corpus-${{ github.sha }}\n          restore-keys: fuzz-corpus-\n\n      - name: Build fuzzing harness\n        run: |\n          export CC=afl-clang-fast\n          export AFL_USE_ASAN=1\n          make fuzz_harness\n\n      - name: Run AFL++ fuzzing (CI mode)\n        env:\n          AFL_CMPLOG_ONLY_NEW: 1\n          AFL_FAST_CAL: 1\n          AFL_NO_STARTUP_CALIBRATION: 1\n        run: |\n          mkdir -p findings\u002F\n          timeout 7200 afl-fuzz \\\n            -S ci_fuzzer \\\n            -i corpus\u002F \\\n            -o findings\u002F \\\n            -t 5000 \\\n            -- .\u002Ffuzz_harness @@ || true\n\n      - name: Check for crashes\n        run: |\n          CRASHES=$(find findings\u002F -path \"*\u002Fcrashes\u002F*\" -not -name \"README.txt\" | wc -l)\n          echo \"Found $CRASHES unique crashes\"\n          if [ \"$CRASHES\" -gt 0 ]; then\n            echo \"::error::AFL++ found $CRASHES crashes\"\n            for crash in findings\u002F*\u002Fcrashes\u002F*; do\n              [ -f \"$crash\" ] && echo \"Crash: $crash ($(wc -c \u003C $crash) bytes)\"\n            done\n            exit 1\n          fi\n\n      - name: Update corpus cache\n        if: always()\n        run: |\n          afl-cmin -i findings\u002Fci_fuzzer\u002Fqueue\u002F -o corpus\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 5 --- Parallel Fuzzing for Nightly Runs\n\n```bash\n# Launch multiple secondary instances for better coverage\nfor i in $(seq 1 $(nproc)); do\n    afl-fuzz -S fuzzer_$i \\\n      -i corpus\u002F \\\n      -o findings\u002F \\\n      -- .\u002Ffuzz_harness @@ &\ndone\n\n# Wait for all fuzzers\nwait\n\n# Merge and minimize corpus\nafl-cmin -i findings\u002F*\u002Fqueue\u002F -o corpus_merged\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 6 --- Crash Triage\n\n```bash\n# Reproduce and categorize crashes\nfor crash in findings\u002F*\u002Fcrashes\u002F*; do\n    echo \"=== Testing: $crash ===\"\n    timeout 5 .\u002Ffuzz_harness_asan \"$crash\" 2>&1 | head -20\n    echo \"---\"\ndone\n\n# Deduplicate crashes by stack trace\nafl-collect findings\u002F crashes_deduped\u002F -- .\u002Ffuzz_harness @@\n```\n\n## CI\u002FCD Best Practices for AFL++\n\n| Setting | CI Short Run | Nightly Long Run |\n|---------|-------------|-----------------|\n| Duration | 30-60 min | 4-24 hours |\n| Mode | `-S` (secondary only) | `-S` (no `-M` for CI) |\n| `AFL_CMPLOG_ONLY_NEW` | 1 | 1 |\n| `AFL_FAST_CAL` | 1 | 0 |\n| `AFL_NO_STARTUP_CALIBRATION` | 1 | 0 |\n| Corpus caching | Required | Required |\n| Parallel instances | 1-2 | nproc |\n\n## Monitoring Fuzzing Campaigns\n\n```bash\n# View fuzzing statistics\nafl-whatsup findings\u002F\n\n# Key metrics to track:\n# - Total paths found (code coverage indicator)\n# - Unique crashes \u002F unique hangs\n# - Stability percentage (should be >90%)\n# - Exec speed (execs\u002Fsec)\n# - Cycles done (full corpus cycles completed)\n```\n\n## References\n\n- [AFL++ Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F)\n- [AFL++ GitHub Repository](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus)\n- [AFL++ Fuzzing in Depth Guide](https:\u002F\u002Faflplus.plus\u002Fdocs\u002Ffuzzing_in_depth\u002F)\n- [Google Testing Handbook - AFL++](https:\u002F\u002Fappsec.guide\u002Fdocs\u002Ffuzzing\u002Fc-cpp\u002Faflpp\u002F)\n- [OWASP Fuzzing Guide](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n","# Implementing Fuzz Testing in CI\u002FCD with AFL++\n\n## Overview\n\nAFL++ (American Fuzzy Lop Plus Plus) is a community-maintained fork of AFL that provides state-of-the-art coverage-guided fuzz testing for discovering vulnerabilities in compiled applications. AFL++ uses genetic algorithms to mutate inputs, tracking code coverage to find new execution paths that trigger crashes, hangs, and undefined behavior. In CI\u002FCD environments, AFL++ can be integrated to continuously test parsers, protocol handlers, file format processors, and any code that handles untrusted input. AFL++ supports persistent mode for high-speed fuzzing (up to 100,000+ executions per second), custom mutators, QEMU mode for binary-only fuzzing, and CmpLog\u002FRedQueen for automatic dictionary extraction.\n\n\n## When to Use\n\n- When deploying or configuring implementing fuzz testing in cicd with aflplusplus capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux-based CI runners (AFL++ does not support Windows natively)\n- GCC or Clang compiler toolchain\n- AFL++ installed (`apt install aflplusplus` or built from source)\n- Target application with harness functions isolating input processing\n- Seed corpus of valid input samples\n\n## Core Concepts\n\n### Coverage-Guided Fuzzing\n\nAFL++ instruments the target binary at compile time (or via QEMU\u002FFrida for binary-only targets) to track which code paths each input exercises. When a mutated input triggers a new code path, it is saved to the corpus for further mutation. This feedback loop enables AFL++ to systematically explore program state space.\n\n### Instrumentation Modes\n\n| Mode | Use Case | Performance |\n|------|----------|-------------|\n| `afl-clang-fast` (LTO) | Source available, best performance | Highest |\n| `afl-clang-fast` | Source available, standard | High |\n| `afl-gcc-fast` | GCC-based projects | High |\n| `QEMU mode` | Binary-only, no source | Medium |\n| `Frida mode` | Binary-only, cross-platform | Medium |\n| `Unicorn mode` | Firmware, embedded | Low |\n\n### Persistent Mode\n\nPersistent mode avoids fork overhead by fuzzing within a loop:\n\n```c\n#include \u003Cunistd.h>\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        \u002F\u002F Process buf[0..len-1]\n        parse_input(buf, len);\n    }\n    return 0;\n}\n```\n\n## Workflow\n\n### Step 1 --- Build the Fuzzing Harness\n\nCreate a harness that feeds AFL++ input to the target function:\n\n```c\n\u002F\u002F fuzz_harness.c\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n#include \"target_parser.h\"\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        if (len \u003C 4) continue;\n\n        \u002F\u002F Reset state between iterations\n        parser_context_t ctx;\n        parser_init(&ctx);\n        parser_process(&ctx, buf, len);\n        parser_cleanup(&ctx);\n    }\n    return 0;\n}\n```\n\n### Step 2 --- Compile with AFL++ Instrumentation\n\n```bash\n# Standard instrumentation\nexport CC=afl-clang-fast\nexport CXX=afl-clang-fast++\n\n# Enable AddressSanitizer for better crash detection\nexport AFL_USE_ASAN=1\n\n# Build the target with instrumentation\n$CC -o fuzz_harness fuzz_harness.c -ltarget_parser -fsanitize=address\n\n# Build a CmpLog binary for better coverage\n$CC -o fuzz_harness_cmplog fuzz_harness.c -ltarget_parser \\\n  -fsanitize=address -DCMPLOG\n```\n\n### Step 3 --- Prepare Seed Corpus\n\n```bash\nmkdir -p corpus\u002F\n# Add valid input samples\ncp test_inputs\u002F* corpus\u002F\n# Minimize the corpus\nafl-cmin -i corpus\u002F -o corpus_min\u002F -- .\u002Ffuzz_harness @@\n# Further minimize individual inputs\nmkdir -p corpus_tmin\u002F\nfor f in corpus_min\u002F*; do\n    afl-tmin -i \"$f\" -o \"corpus_tmin\u002F$(basename $f)\" -- .\u002Ffuzz_harness @@\ndone\n```\n\n### Step 4 --- Configure CI\u002FCD Integration\n\n**GitHub Actions:**\n\n```yaml\nname: devsecops-fuzz\non:\n  push:\n    branches: [main]\n  schedule:\n    - cron: '0 2 * * *'  # Nightly fuzzing\n\njobs:\n  fuzz:\n    runs-on: ubuntu-latest\n    timeout-minutes: 120\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Install AFL++\n        run: |\n          sudo apt-get update\n          sudo apt-get install -y aflplusplus\n\n      - name: Restore corpus cache\n        uses: actions\u002Fcache@v4\n        with:\n          path: corpus\u002F\n          key: fuzz-corpus-${{ github.sha }}\n          restore-keys: fuzz-corpus-\n\n      - name: Build fuzzing harness\n        run: |\n          export CC=afl-clang-fast\n          export AFL_USE_ASAN=1\n          make fuzz_harness\n\n      - name: Run AFL++ fuzzing (CI mode)\n        env:\n          AFL_CMPLOG_ONLY_NEW: 1\n          AFL_FAST_CAL: 1\n          AFL_NO_STARTUP_CALIBRATION: 1\n        run: |\n          mkdir -p findings\u002F\n          timeout 7200 afl-fuzz \\\n            -S ci_fuzzer \\\n            -i corpus\u002F \\\n            -o findings\u002F \\\n            -t 5000 \\\n            -- .\u002Ffuzz_harness @@ || true\n\n      - name: Check for crashes\n        run: |\n          CRASHES=$(find findings\u002F -path \"*\u002Fcrashes\u002F*\" -not -name \"README.txt\" | wc -l)\n          echo \"Found $CRASHES unique crashes\"\n          if [ \"$CRASHES\" -gt 0 ]; then\n            echo \"::error::AFL++ found $CRASHES crashes\"\n            for crash in findings\u002F*\u002Fcrashes\u002F*; do\n              [ -f \"$crash\" ] && echo \"Crash: $crash ($(wc -c \u003C $crash) bytes)\"\n            done\n            exit 1\n          fi\n\n      - name: Update corpus cache\n        if: always()\n        run: |\n          afl-cmin -i findings\u002Fci_fuzzer\u002Fqueue\u002F -o corpus\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 5 --- Parallel Fuzzing for Nightly Runs\n\n```bash\n# Launch multiple secondary instances for better coverage\nfor i in $(seq 1 $(nproc)); do\n    afl-fuzz -S fuzzer_$i \\\n      -i corpus\u002F \\\n      -o findings\u002F \\\n      -- .\u002Ffuzz_harness @@ &\ndone\n\n# Wait for all fuzzers\nwait\n\n# Merge and minimize corpus\nafl-cmin -i findings\u002F*\u002Fqueue\u002F -o corpus_merged\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 6 --- Crash Triage\n\n```bash\n# Reproduce and categorize crashes\nfor crash in findings\u002F*\u002Fcrashes\u002F*; do\n    echo \"=== Testing: $crash ===\"\n    timeout 5 .\u002Ffuzz_harness_asan \"$crash\" 2>&1 | head -20\n    echo \"---\"\ndone\n\n# Deduplicate crashes by stack trace\nafl-collect findings\u002F crashes_deduped\u002F -- .\u002Ffuzz_harness @@\n```\n\n## CI\u002FCD Best Practices for AFL++\n\n| Setting | CI Short Run | Nightly Long Run |\n|---------|-------------|-----------------|\n| Duration | 30-60 min | 4-24 hours |\n| Mode | `-S` (secondary only) | `-S` (no `-M` for CI) |\n| `AFL_CMPLOG_ONLY_NEW` | 1 | 1 |\n| `AFL_FAST_CAL` | 1 | 0 |\n| `AFL_NO_STARTUP_CALIBRATION` | 1 | 0 |\n| Corpus caching | Required | Required |\n| Parallel instances | 1-2 | nproc |\n\n## Monitoring Fuzzing Campaigns\n\n```bash\n# View fuzzing statistics\nafl-whatsup findings\u002F\n\n# Key metrics to track:\n# - Total paths found (code coverage indicator)\n# - Unique crashes \u002F unique hangs\n# - Stability percentage (should be >90%)\n# - Exec speed (execs\u002Fsec)\n# - Cycles done (full corpus cycles completed)\n```\n\n## References\n\n- [AFL++ Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F)\n- [AFL++ GitHub Repository](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus)\n- [AFL++ Fuzzing in Depth Guide](https:\u002F\u002Faflplus.plus\u002Fdocs\u002Ffuzzing_in_depth\u002F)\n- [Google Testing Handbook - AFL++](https:\u002F\u002Fappsec.guide\u002Fdocs\u002Ffuzzing\u002Fc-cpp\u002Faflpp\u002F)\n- [OWASP Fuzzing Guide](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n",{"name":5,"tags":52,"capec":60,"model":30,"tools":61,"domain":40,"maxTurns":65,"nist_csf":66,"subdomain":27,"description":7,"nist_ai_rmf":71,"mitre_attack":75,"atlas_techniques":77},[53,54,55,56,57,58,59],"aflplusplus","fuzz-testing","cicd","coverage-guided-fuzzing","security-testing","vulnerability-discovery","afl",[],[62,38,63,64],"Read","Glob","Grep",20,[67,68,69,70],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04",[72,73,74],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[76],"T1082",[78,79,80],"AML.T0070","AML.T0066","AML.T0082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fdevsecops\u002Ffuzz\u002Fenum","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":89,"prompt":99,"zipAvailable":100},[90,93,96],{"tool":91,"command":92},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill devsecops-fuzz-enum",{"tool":94,"command":95},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill devsecops-fuzz-enum",{"tool":97,"command":98},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill devsecops-fuzz-enum","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fdevsecops\u002Ffuzz\u002Fenum\u002FSKILL.md",true,[102],{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"index.json","REFERENCE","参考文档",642,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fdevsecops\u002Ffuzz\u002Fenum\u002Findex.json",[109,134,155,176,198,213],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":47},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,40,133],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":47},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[141,116,142,119,143,144,145,40,38,146,147,148,149,150,121,151,152,35,153,154],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":47},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[162,163,164,165,166,167,40,38,168,146,169,170,121,35,171,172,173,174,175,30],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":47},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[117,183,184,185,186,187,188,122,189,40,133,190,191,192,193,194,195,196,197,121],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":47},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[205,206,117,207,185,187,44,122,208,189,40,133,146,209,210,211,212,197,121,123],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":219,"publishedAt":47},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[220,117,185,221,44,122,222,223,40,133,224,225,226,227,228,229,121,123,230,231],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]