Skill UI

Provides a workflow for authorized penetration testing across AWS, Azure, and GCP to discover IAM, storage, serverless, and compute weaknesses, leveraging Pacu, ScoutSuite, Prowler, and cloud-native tools.

Guides authorized AWS penetration testing with Pacu, covering IAM enumeration, privilege escalation scanning, data access checks, and detection validation for cloud red-team and compliance exercises.

Provides step-by-step practices for testers to probe file path parameters, fuzz traversal payloads, and leverage tools (Burp, ffuf, dotdotpwn) to detect and escalate path traversal or LFI/RFI flaws.

Performs coverage-guided fuzzing on compiled binaries using the AFL++ toolchain, automating instrumentation, corpus minimization, parallel campaigns, and crash triage to uncover memory corruption and security flaws during assessments.

Assesses GraphQL API endpoints during authorized tests to expose introspection leaks, injection flaws, access control gaps, and denial-of-service risks across web, mobile, and microservice backends.

Guide for integrating Hardware Security Modules via PKCS#11—covering slot/token discovery, key creation, signing, verification, and compliance reporting with python-pkcs11, AWS CloudHSM, and YubiHSM2 in security assessments or audits.

A guided workflow for auditing AWS Lambda, Azure Functions, and GCP Cloud Functions to catch permissive execution roles, exposed secrets, and missing runtime protections before deployment.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

Provides step-by-step procedures to detect and remediate misconfigured Amazon S3 buckets, including enabling public access blocks, auditing policies and ACLs, enforcing encryption, and automating fixes with AWS Config and Lambda for compliance or incident response scenarios.

Guides securing public API Gateway endpoints using AWS WAF managed rule groups for OWASP coverage, custom rate limits, bot control, IP reputation filtering, and metric monitoring to keep attacks and abuse in check.

Guides security teams through inventorying IAM identities, analyzing Access Analyzer findings, scoping policies, applying permission boundaries, and enforcing MFA to minimize the blast radius of compromised AWS identities.