Skill UI

A dedicated tool for forensic analysis of Windows PowerShell Script Block Logs (Event ID 4104) captured in EVTX files. It reconstructs multi-block scripts, applying advanced detection heuristics such as entropy analysis and pattern matching to identify obfuscated commands, encoded payloads (Base64), download cradles, and AMSI bypass attempts, crucial for threat hunting and incident response.

A comprehensive toolkit designed for cybersecurity professionals to deobfuscate malicious JavaScript code. It reverses complex encoding layers (Base64, Hex, Unicode), eval chains, and control flow obfuscation techniques found in phishing pages, web skimmers, and dropper scripts, revealing the original malicious logic for thorough forensic analysis and threat intelligence gathering.

This script is designed for malware analysis, specifically targeting .NET-based Remote Access Trojans (RATs) like Agent Tesla. It automatically extracts embedded and obfuscated configuration data, including SMTP credentials, FTP endpoints, Telegram tokens, and C2 webhooks. It utilizes advanced techniques such as regex pattern matching, Base64 decoding, and simulating XOR/SHA256 decryption to reveal critical threat intelligence for security research.

This comprehensive playbook provides expert techniques for classical cipher identification and breaking. It covers fundamental methods like frequency analysis, Kasiski examination, and Index of Coincidence (IC), enabling the decryption of monoalphabetic, polyalphabetic, and transposition ciphers (Vigenere, Caesar, Playfair, etc.). It also guides the decoding of various formats (Base64, Hex, Morse).

Designed to capture a fully functional, standalone static HTML file from any modern web application (React, Next.js, Vue, etc.). It resolves all computed styles and inlines CSS and images (as Base64) into the output, ensuring the captured view can be shared or archived without external dependencies. Supports both automated snapshotting via Puppeteer and interactive capture.