Skill UI

This guide teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous, comprehensive threat detection across entire AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting various finding severity levels, and building robust, automated incident response playbooks using EventBridge and AWS Lambda for immediate containment actions.

This script detects and analyzes sophisticated fileless malware techniques that operate entirely in system memory. It specializes in identifying threats that utilize Living Off the Land Binaries (LOLBins), WMI event subscriptions, and registry-resident payloads, bypassing traditional file-based security controls. It is ideal for forensic investigations, threat hunting, and building advanced detection rules in modern enterprise environments.

This tool analyzes Web Application Firewall (WAF) logs (ModSecurity, AWS WAF, Cloudflare) to detect sophisticated SQL injection attack campaigns. It parses diverse log formats, identifies common SQLi payloads (UNION SELECT, OR 1=1), correlates multi-stage attacks, tracks source IPs, and generates detailed incident reports classified by OWASP standards for SOC analysts and security researchers.

A comprehensive guide for authorized penetration testers on identifying and exploiting insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET). Covers techniques for generating payloads using tools like ysoserial and phpggc, and testing various application components such as cookies, HTTP parameters, and message queues to achieve potential Remote Code Execution (RCE).

A comprehensive guide and set of payloads for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. This skill covers various template engines like Jinja2, Twig, Freemarker, and more, allowing users to achieve Remote Code Execution (RCE) during penetration testing.

This skill provides advanced threat hunting techniques to detect unauthorized data exfiltration. It guides the analysis of network traffic, DNS queries, and cloud uploads to identify unusual data flows, DNS tunneling, and abuse of encrypted channels, essential for incident response and preventing data loss.

Scans web server roots for high-entropy files, suspicious PHP/JSP/ASP payloads, and recent modifications to flag obfuscated webshells via entropy thresholds, regex signatures, and file metadata.

This utility implements comprehensive Cloud Workload Protection (CWPP) by monitoring compute workloads on cloud instances (EC2/GCE). It provides runtime security controls, detecting process anomalies, unauthorized binary execution, cryptomining activity, and suspicious network connections using AWS and Google APIs. Ideal for establishing robust security postures and meeting compliance requirements.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

This skill details advanced methodologies for bypassing Content Security Policy (CSP) protections. It covers exploiting misconfigurations, such as using 'unsafe-inline' or 'unsafe-eval', leveraging JSONP endpoints, manipulating base-uri, and leaking nonces. It is essential for web application penetration testing and security auditing when standard XSS payloads are blocked by CSP.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.