Skill UI

This comprehensive skill guide details the implementation of robust and secure API authentication systems. It covers industry standards like JWT, OAuth 2.0 (including various flows), and API key management. Key features include role-based access control (RBAC), refresh token rotation, session management, and brute-force protection, ensuring secure communication for diverse service architectures.

Walks through broken authentication assessments by analyzing login flows, password policies, brute-force/credential-stuffing, and session/token security to document vulnerabilities and mitigation steps for web applications.

This skill provides a comprehensive framework for implementing robust API rate limiting. It supports advanced algorithms like sliding windows, token buckets, and fixed counters, backed by Redis for distributed state. Use it to protect endpoints from excessive requests, enforce tiered quotas (Free, Pro, Enterprise), and prevent abuse like brute-force attacks by setting per-user, per-endpoint, or per-API-key limits.

This comprehensive guide configures Fail2ban to implement a robust, layered defense mechanism for network security. It sets up custom filters and actions to automatically detect and mitigate threats such as port scanning, SSH brute force attempts, and network reconnaissance. By dynamically banning malicious IP addresses and providing security alerts, this skill significantly enhances the host-based intrusion prevention capabilities of your system.

This skill provides a structured method for analyzing Windows Security Event Logs (EVTX) to detect brute force attacks targeting RDP endpoints. It involves parsing failed logon events (Event ID 4625) and correlating them with successful logons (Event ID 4624), while also analyzing source IP frequency and NLA bypass attempts. Ideal for security incident investigation, blue-team threat hunting, and building SIEM detection rules.

This skill covers implementing robust API abuse detection using advanced rate-limiting algorithms like Token Bucket and Sliding Window. It uses Redis for distributed counting and allows for adaptive limits, dynamically tightening during detected attacks and relaxing during normal traffic. Ideal for securing APIs against DDoS, brute force, and scraping attacks.

Details how to implement robust API rate limiting and throttling using advanced techniques like Token Bucket, Sliding Window, and Fixed Window algorithms. Supports per-user, per-IP, and per-endpoint quotas, utilizing Redis for distributed counting. Essential for protecting APIs against brute force, credential stuffing, and resource exhaustion attacks, returning proper HTTP 429 responses.

A comprehensive security assessment guide and script to test API rate limit vulnerabilities. It evaluates if an API's security controls can be bypassed using advanced techniques such as IP spoofing (manipulating X-Forwarded-For headers), HTTP method variations, and endpoint path traversal. Designed for penetration testing, it helps assess resilience against brute-force or resource exhaustion attacks, aligning with OWASP API Top 10 findings.

This comprehensive guide details the process of capturing WPA/WPA2 handshakes and performing offline dictionary and brute-force password cracking. It utilizes industry-standard tools like aircrack-ng and hashcat to assess the strength of wireless network security during authorized penetration tests. It covers everything from interface preparation to final report generation.

Methodology for assessing WPS-enabled routers using Pixie Dust offline recovery, online PIN brute force, lockout handling, and PBC edge cases. Useful for wireless security testing and understanding WPS exposure on consumer APs.

A comprehensive playbook for identifying authentication vulnerabilities in web applications. Covers advanced topics including SQL injection login bypass, predictable password reset tokens, account enumeration techniques, multi-factor authentication bypass, and brute-force resistance checks. Essential for penetration testers assessing login mechanisms and session management.

This skill enforces an algorithm-first discipline, requiring the user to state the time and space complexity (Big-O), the intended data structure, and the core algorithm family before writing any complex code (loops, queries, recursion). It serves as a critical gatekeeper to prevent common performance pitfalls like O(n²) complexity, N+1 database queries, and brute-force implementation errors, significantly improving code robustness and efficiency.