Skill UI

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

This skill utilizes Impacket to perform comprehensive audits and simulated attacks on Active Directory forest trust relationships. It enumerates trust boundaries, analyzes SID filtering configurations, detects SID history abuse vectors, and assesses inter-realm Kerberos ticket risks. Ideal for red-teaming multi-forest environments or performing deep security audits to find cross-forest privilege escalation paths.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

Techniques for attacking WPA/WPA2/WPA3-Enterprise 802.1X networks, including EAP method identification, evil-twin RADIUS credential capture, MSCHAPv2 cracking, and EAP-TLS certificate theft paths in corporate Wi-Fi environments.

This comprehensive playbook details advanced techniques for detecting Prototype Pollution vulnerabilities in JavaScript environments (Node.js and browser). It covers various attack vectors, including using `__proto__` and `constructor.prototype` paths, and provides black-box testing payloads for JSON parsing, query string merging, and deep object assignment. Use this when analyzing applications for potential Remote Code Execution (RCE) or unintended property leakage via object merging sinks.

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.

Orchestrates authorized multi-stage security engagements spanning reconnaissance, initial access, privilege escalation, and lateral movement. Plans coherent attack paths and coordinates specialist tools for comprehensive penetration testing and red team operations.

Build comprehensive attack trees to visualize threat paths, identify defense gaps, and communicate security risks during authorized security assessments.

Detect exploitable vulnerabilities in GitHub Actions workflows by tracing concrete attack paths from external attackers — pwn requests, expression injection, credential escalation, supply chain risks — and report only verified, evidence-based findings with full exploitation scenarios.