Skill UI

This solution guides the implementation of a phishing reporting button within email clients, creating a critical feedback loop for security teams. By integrating with SOAR platforms, reported suspicious emails undergo automated triage, including IOC extraction, sandbox analysis, and threat intelligence checks. The workflow enables rapid classification, automated remediation (e.g., mass retraction, sender blocking), and provides detailed feedback to the user reporter, significantly enhancing overall security posture.

This framework provides a systematic methodology for cybersecurity professionals to transform raw threat intelligence, observed attack patterns, and environmental telemetry into verifiable, testable hunting hypotheses. It guides the end-to-end process, from hypothesis formulation and data identification across SIEM/EDR systems, to deep correlation and reporting, enabling proactive threat detection and scope assessment.

MISP (Malware Information Sharing Platform) is an open-source platform designed for gathering, storing, and correlating Indicators of Compromise (IOCs). This skill guides users through deploying MISP using Docker, configuring various threat feeds (MISP, TAXII, CSV), and utilizing the PyMISP Python API. It enables the building of automated pipelines to aggregate diverse threat data, such as IP addresses, domains, and hashes, for enhanced security operations.

This skill provides a comprehensive guide to configuring Hardware Security Modules (HSMs) using the industry-standard PKCS#11 interface. It details best practices for key generation, secure key storage, and cryptographic operations (signing, encryption, decryption). Learn how to manage keys in a tamper-resistant environment, ensuring private keys never leave the device boundary. Applicable for building compliance-grade security architectures across finance and government sectors.

This skill guides security testers in identifying excessive data exposure in REST and GraphQL APIs. It involves intercepting API responses and analyzing them for leaked Personally Identifiable Information (PII), internal identifiers, or sensitive business data that the client UI does not display but the API transmits. It maps directly to OWASP API3:2023 Broken Object Property Level Authorization, helping prevent data leaks via over-fetching.

This comprehensive guide details the methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities. It teaches users how to systematically test broken access control in modern web applications and APIs. By manipulating predictable object identifiers (such as user IDs, order numbers, or document slugs), testers can validate if object-level authorization is properly enforced, preventing unauthorized horizontal or vertical data access.

This skill detects anti-forensic timestomping by analyzing NTFS Master File Table (MFT) entries. It compares timestamps from the $STANDARD_INFORMATION attribute (user-modifiable) against the $FILE_NAME attribute (kernel-protected). Discrepancies, such as SI Created < FN Created, strongly indicate malicious manipulation and defense evasion. This methodology is crucial for advanced threat hunting and digital forensic investigations.

This tool systematically generates, validates, and ranks concrete, publishable research ideas based on a broad research direction provided by the user. It guides the user through the entire idea discovery pipeline, from initial landscape survey (Phase 1) to validation (novelty checks, experiments) and review, ensuring the generated ideas are novel and relevant for academic publication. It manages complex workflow orchestration and utilizes multiple external tools.

This guide details the implementation of robust API abuse detection mechanisms. It covers advanced rate limiting techniques, such as the Token Bucket and Sliding Window algorithms, to defend APIs against DDoS attacks, brute force attempts, and credential stuffing. It emphasizes using distributed stores like Redis for accurate, scalable, and adaptive security controls in an API gateway context.

This comprehensive guide details how to implement centralized security controls at the API gateway layer. It covers critical functionalities such as JWT authentication enforcement, advanced rate limiting, request/response validation against OpenAPI specs, and integrating Web Application Firewalls (WAF). The process is applicable across major platforms like Kong, AWS API Gateway, and Azure APIM, ensuring robust defense in depth for microservices architecture.

A comprehensive guide for integrating DevSecOps practices into CI/CD pipelines. It automates security testing by incorporating Static Application Security Testing (SAST), Dependency/IaC Scanning (SCA), Secrets Detection, and Dynamic Application Security Testing (DAST). Use this workflow to shift security left, enforce compliance, and establish security gates that block vulnerable deployments.

This skill provides a deep dive into implementing robust End-to-End Encryption (E2EE) for messaging applications. It simulates key components of the Signal Protocol, including X3DH for initial key exchange and the Double Ratchet algorithm for ongoing key management. It ensures forward secrecy, meaning even if a key is compromised, past messages remain secure. Use this when building highly secure, compliant communication systems.