Skill UI

This skill focuses on identifying and exploiting type juggling vulnerabilities in PHP web applications. It demonstrates techniques such as loose comparison bypass (==), type coercion using JSON/serialized input, and leveraging magic hash collisions to circumvent authentication mechanisms, password verification, and general application logic checks in a controlled security testing environment.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.

A comprehensive guide for implementing Cloud Security Posture Management (CSPM) across multi-cloud environments (AWS, Azure, GCP). Learn how to use specialized tools like Prowler and ScoutSuite, combined with native cloud services (Security Hub, Defender, SCC), to continuously monitor for misconfigurations, compliance violations (CIS, SOC 2), and security drifts, thereby enforcing security guardrails in complex cloud architectures.

This skill guides the implementation of envelope encryption using AWS Key Management Service (KMS). Envelope encryption is a robust security pattern where data is encrypted locally using a Data Encryption Key (DEK), and the DEK itself is protected by a master Key Encryption Key (KEK) managed by AWS KMS. This approach overcomes the limitations of direct KMS encryption, enabling unlimited data size encryption, reducing latency, and allowing offline encryption capabilities by keeping the master key secure in an HSM.

This guide details implementing robust container image provenance verification using Cosign, a Sigstore tool. It covers key-based and keyless (OIDC) signing methods, enabling secure supply chain practices. Users can sign images, attach critical attestations (such as SBOMs and vulnerability scans), and enforce verification in CI/CD pipelines and Kubernetes environments to ensure high integrity and trust.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

This skill guide details how to build a robust, SCIM 2.0-compliant API endpoint to manage user identities automatically. It focuses on integrating this API with Okta as an Identity Provider (IdP), enabling automated provisioning, deprovisioning, and attribute synchronization for seamless user lifecycle management in enterprise environments.

This skill guides the implementation of security chaos engineering experiments. It involves deliberately degrading or disabling security controls (like WAF, firewalls, or log pipelines) in a controlled environment to rigorously verify the detection, alerting, and response capabilities of the Security Operations Center (SOC). Users learn to use tools like boto3 and Python to simulate failure scenarios and assess system resilience and compliance posture.

Automate comprehensive vulnerability management by deploying and operating Greenbone/OpenVAS. This skill guides the use of the python-gvm library to programmatically manage the entire scanning lifecycle: creating scan targets, executing complex vulnerability scans via the Greenbone Management Protocol (GMP), monitoring progress, and parsing detailed XML reports into actionable JSON findings. Ideal for security assessments and compliance checks.

This guide details the implementation of Zero Trust Architecture for securing Software as a Service (SaaS) applications. It leverages Conditional Access Policies, CASB (Cloud Access Security Broker), and Identity Governance to enforce strict identity verification, device compliance, and data loss prevention (DLP) across cloud environments (e.g., M365, Salesforce). It helps mitigate risks associated with shadow IT and excessive application permissions.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.