Skill UI

Guide for integrating Hardware Security Modules via PKCS#11—covering slot/token discovery, key creation, signing, verification, and compliance reporting with python-pkcs11, AWS CloudHSM, and YubiHSM2 in security assessments or audits.

A guided workflow for auditing AWS Lambda, Azure Functions, and GCP Cloud Functions to catch permissive execution roles, exposed secrets, and missing runtime protections before deployment.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

Provides step-by-step procedures to detect and remediate misconfigured Amazon S3 buckets, including enabling public access blocks, auditing policies and ACLs, enforcing encryption, and automating fixes with AWS Config and Lambda for compliance or incident response scenarios.

Guides securing public API Gateway endpoints using AWS WAF managed rule groups for OWASP coverage, custom rate limits, bot control, IP reputation filtering, and metric monitoring to keep attacks and abuse in check.

Guides security teams through inventorying IAM identities, analyzing Access Analyzer findings, scoping policies, applying permission boundaries, and enforcing MFA to minimize the blast radius of compromised AWS identities.

Guides cloud security teams through setting up Microsoft Defender for Cloud to protect Azure workloads, extend CNAPP coverage to AWS/GCP, manage Secure Score, and monitor threats centrally via the unified Defender portal.

Harden serverless compute on AWS Lambda, Azure Functions, and Google Cloud Functions by enforcing least-privilege IAM roles, moving secrets into vaults, scanning dependencies, validating inputs, securing function URLs, and monitoring runtimes so injections, credential theft, and supply-chain threats are caught before deployment.

Scans REST APIs for authentication flaws by probing endpoints, JWT/OAuth flows, API key handling, and session management to highlight broken validation, missing auth layers, and credential weaknesses before production rollout.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Manual penetration testing focused on business logic vulnerabilities in web applications, covering price manipulation, workflow bypasses, privilege escalation, and race conditions when automated scanners miss critical flaws.