Skill UI

Automate Brilliant Directories tasks through Composio's Rube MCP toolkit, making sure you always discover tools, verify connections, and execute schema-compliant workflows for both single and bulk operations.

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

This skill guides the setup of Host-Based Intrusion Detection Systems (HIDS) using industry-standard tools like Wazuh, OSSEC, or AIDE. It covers essential security practices, including File Integrity Monitoring (FIM) for critical directories, monitoring system calls, detecting configuration changes, and identifying rootkits. It is crucial for meeting regulatory compliance requirements (e.g., PCI DSS) and significantly enhancing overall endpoint security posture.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

This technique exploits the Active Directory attribute `msDS-KeyCredentialLink` by injecting attacker-controlled public keys (Shadow Credentials). Using tools like pyWhisker and Certipy, the attacker forces the target account to register a new key. Subsequently, by leveraging PKINIT (Public Key Cryptography for Initial Authentication in Kerberos), the attacker can obtain a service ticket and recover the target's NT hash, achieving a stealthy, password-less, complete account takeover.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.