Skill UI

A wireless 802.11 offensive testing methodology for red team and security assessments. It covers monitor-mode setup, handshake and PMKID capture, WPA3/Enterprise attacks, evil twin setups, WPS abuse, and related wireless intrusion techniques.

Methodology for passive Wi-Fi reconnaissance: choose compatible adapters, enable monitor mode, set regulatory domains, sweep 2.4/5/6 GHz bands, identify hidden SSIDs, clients, vendors, and encryption before active wireless attacks.

Techniques for attacking WPA/WPA2/WPA3-Enterprise 802.1X networks, including EAP method identification, evil-twin RADIUS credential capture, MSCHAPv2 cracking, and EAP-TLS certificate theft paths in corporate Wi-Fi environments.

A workflow for capturing PMKID or four-way handshakes from WPA/WPA2-Personal networks, converting captures to hashcat format, and cracking passwords with dictionaries, masks, and vendor default-key patterns.

Covers WPA3/SAE attack techniques including transition-mode downgrade, Dragonblood side-channel analysis, SAE authentication flooding, H2E checks, and Wi-Fi 6E implications. Useful for assessing wireless security gaps and validating defensive hardening.

Methodology for assessing WPS-enabled routers using Pixie Dust offline recovery, online PIN brute force, lockout handling, and PBC edge cases. Useful for wireless security testing and understanding WPS exposure on consumer APs.

A comprehensive methodology for identifying critical vulnerabilities in transactional applications (e-commerce, fintech, SaaS). This goes beyond standard OWASP Top 10 checks, focusing on flaws like workflow bypass, state machine violations, price manipulation, and role boundary abuse. It guides testers to map application flows, identify hidden endpoints, and quantify the potential financial impact of logic failures.

This skill provides advanced threat hunting queries for Microsoft Sentinel/Log Analytics. It detects the behavioral and string fingerprints left by popular offensive Entra ID enumeration tools (like ROADtools, AADInternals, and AzureHound) within both MicrosoftGraphActivityLogs and AADGraphActivityLogs. Use this when investigating suspicious Graph API activity, identifying internal reconnaissance, or building detection rules to surface active intrusions.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

A comprehensive guide for red team operators detailing techniques to manipulate, clear, or destroy digital evidence on Windows and Linux systems. Covers clearing Windows Event Logs (wevtutil), manipulating Linux system logs, timestamp forgery, file system scrubbing, and memory artifact removal. Essential for understanding advanced evasion methods and achieving operational security during authorized engagements.

Covers advanced API exploitation methodologies, focusing on business logic abuse, API call chaining, and sophisticated attack patterns that bypass traditional security controls. Topics include GraphQL abuse (batching, introspection), JWT manipulation (algorithm confusion), race conditions, and identifying API key leakage. This guide is designed for authorized penetration testers targeting deep-seated, logic-layer vulnerabilities.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.