Skill UI

This tool simulates advanced security testing to identify vulnerabilities in API rate limiting. It bypasses throttling controls by manipulating request headers (like X-Forwarded-For spoofing), varying source IP addresses, and manipulating endpoint paths. Essential for assessing API resilience against brute-force attacks, credential stuffing, and resource exhaustion, aligning with OWASP API Security guidelines.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

A comprehensive guide for analyzing binary exploitation techniques, covering buffer overflows, ROP chains, and memory corruption vulnerabilities. It details the use of specialized tools like pwntools, checksec, and ROPgadget for identifying and developing exploits in ELF binaries during authorized security assessments and CTF challenges. Focuses on advanced offensive security practices.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

This skill guides authorized security professionals through testing web applications for clickjacking vulnerabilities. It involves checking frame embedding controls (like X-Frame-Options and CSP) and crafting complex proof-of-concept overlays to see if users can be tricked into performing unintended sensitive actions, such as deleting accounts or transferring funds.

Cartography is a CNCF project designed to perform comprehensive cloud asset inventory across AWS, GCP, and Azure. It queries cloud APIs to aggregate infrastructure resources, map complex relationships (like IAM permissions and network paths), and store them in a Neo4j graph database. This allows security teams to visualize potential attack paths, conduct deep security audits, and identify cross-cloud misconfigurations.

Provides a workflow for authorized penetration testing across AWS, Azure, and GCP to discover IAM, storage, serverless, and compute weaknesses, leveraging Pacu, ScoutSuite, Prowler, and cloud-native tools.

A comprehensive guide and workflow for performing authorized penetration testing on AWS environments using the open-source Pacu framework. This skill covers enumerating IAM configurations, identifying privilege escalation paths, testing credential harvesting, and validating security controls across S3, EC2, Lambda, and Secrets Manager. It is designed for red team exercises and risk assessment when auditing cloud infrastructure security.

This skill provides methods for comprehensive forensic acquisition of data from major cloud services, including Google Drive, OneDrive, Dropbox, and Box. It collects evidence through both API-based remote acquisition and local endpoint artifact analysis, making it essential for incident response, security assessments, and digital forensic investigations.

This comprehensive guide details industry best practices for container image hardening. It covers minimizing attack surface through multi-stage builds, utilizing distroless images, enforcing non-root users, and configuring read-only root filesystems. The techniques ensure compliance with standards like the CIS Docker Benchmark, making images secure and production-ready.

This skill demonstrates how to use Trivy, an open-source security scanner, to perform comprehensive container security assessments. It scans container images, Kubernetes manifests, and Infrastructure as Code (IaC) files for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues. Key features include generating Software Bill of Materials (SBOM) for supply chain transparency and integrating scanning gates into CI/CD pipelines, supporting robust DevSecOps practices.

This skill details advanced methodologies for bypassing Content Security Policy (CSP) protections. It covers exploiting misconfigurations, such as using 'unsafe-inline' or 'unsafe-eval', leveraging JSONP endpoints, manipulating base-uri, and leaking nonces. It is essential for web application penetration testing and security auditing when standard XSS payloads are blocked by CSP.