Skill UI

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

This guide details how to perform coverage-guided fuzzing on compiled binaries using AFL++ (American Fuzzy Lop Plus Plus). It covers the entire workflow: instrumenting targets, managing input corpora, running parallel fuzzing campaigns, and triaging complex crashes using tools like CASR or GDB. Ideal for security assessment, crash discovery, and validating application security controls.

This skill details advanced techniques for performing stealthy lateral movement across Windows domains using Windows Management Instrumentation (WMI). It covers the abuse of native tools like Impacket's wmiexec.py and CrackMapExec, enabling remote command execution, Pass-the-Hash attacks, and fileless techniques, crucial for authorized red team engagements and security auditing.

This comprehensive guide details a multi-step workflow for detecting and extracting covert data hidden within images, audio, and video files. It covers initial metadata analysis, running advanced steganalysis tools (like zsteg, binwalk, stegoveritas), and performing low-level analysis such as Least Significant Bit (LSB) analysis to uncover hidden communication channels used in digital forensics and cybersecurity investigations.

This comprehensive guide details the process of capturing WPA/WPA2 handshakes and performing offline dictionary and brute-force password cracking. It utilizes industry-standard tools like aircrack-ng and hashcat to assess the strength of wireless network security during authorized penetration tests. It covers everything from interface preparation to final report generation.

A comprehensive guide detailing how to identify and validate Cross-Site Scripting (XSS) vulnerabilities using Burp Suite's advanced tools (Repeater, Intruder, DOM Invader). This methodology covers reflected, stored, and DOM-based XSS, and includes strategies for bypassing security filters and Content Security Policy (CSP), making it essential for web application penetration testing and bug bounty programs.

A comprehensive guide to diagnosing and resolving performance bottlenecks in React applications. This skill teaches advanced techniques like state isolation, memoization (using `useMemo`, `useCallback`, and `React.memo`), and list virtualization. It guides users through profiling using React DevTools to identify render hotspots, ensuring components render efficiently and maintain high application responsiveness.

This comprehensive guide implements External Attack Surface Management (EASM). It integrates leading industry tools like Shodan, Censys, subfinder, httpx, and nuclei for deep reconnaissance. Users can systematically discover assets, enumerate subdomains, fingerprint services, scan for vulnerabilities, and calculate weighted exposure scores based on professional OWASP methodology. Ideal for continuous security monitoring and deep penetration testing.

This tool transforms natural language requirements into high-quality, structured Mermaid diagrams. It supports over 20 diagram types, including Flowcharts, Sequence Diagrams, Class Diagrams, ER Diagrams, and Gantt Charts. The process includes parsing requirements, generating raw Mermaid code, and verifying syntax using industry-standard tools, ensuring accurate and professional visualizations for technical documentation.

This advanced assistant profiles specified targets (scripts, processes, GPU, memory, etc.) to identify performance bottlenecks. It selects appropriate profiling strategies, runs external tools (e.g., cProfile, nvidia-smi), and can write code instrumentation to measure CPU, GPU, memory, and interconnect overheads. It generates a detailed, actionable report.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.