Skill UI

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

A rigorous method for authorized adversarial security review. It models the attacker, maps the entire attack surface (APIs, auth flows, data handling), and generates reports containing only findings with a concrete, reproducible exploit path and verified mitigation steps. Essential for pre-launch hardening and critical system reviews.

Coordinates authorized multi-stage security assessments including full penetration testing, external-to-domain compromise, and attack path planning. The skill acts as a central orchestrator, routing reconnaissance, initial access, privilege escalation, lateral movement, and reporting tasks to specialized sub-skills. Intended for authorized engagements only.

This skill provides comprehensive management of the Web Application Firewall (WAF) for Power Pages production sites. It allows users to check the current protection status, recommend necessary security measures, and apply granular rules such as IP blocking, country restrictions, path access controls, and rate limits. Use it to secure sites against brute-force attacks or common web vulnerabilities.

Orchestrates authorized multi-stage penetration testing workflows spanning reconnaissance, initial access, privilege escalation, and lateral movement. Coordinates specialist skills to plan coherent attack paths, manage risk, and generate comprehensive security assessment reports for red team engagements and authorized security assessments.

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders. This skill guides decomposition into sub-goals with AND/OR structure, annotates leaves with cost, skill, time, and detectability, and maps mitigations to prioritize high-impact paths.

Generate, refine, and validate diagrams from natural language, notes, code, or schemas. Supports Mermaid, Graphviz, and PlantUML for flowcharts, architecture, and state machines. Ideal for turning textual analysis into visuals, producing attack-path graphs, or creating editable diagram sources for reports and documentation.

Identify and exploit file path traversal vulnerabilities to read arbitrary server files. Used in security assessments to test web application security against directory traversal attacks.

Expert in handling file uploads and cloud storage solutions like S3 and Cloudflare R2. Covers presigned URLs, multipart uploads, and image optimization. Ensures security by validating file types and preventing path traversal attacks. Optimizes performance for large files without blocking.

Hunt LDAP injection and XPath injection vulnerabilities in web applications. Covers authentication bypass, blind attribute exfiltration, and Active Directory vs generic LDAP differences. Includes attack surface signals, filter grammar, and authorized-use guidance.