Skill UI

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

Bun is a high-performance, all-in-one JavaScript runtime and toolchain. It functions as a runtime, package manager, bundler, and test runner, offering significant speed improvements over traditional Node.js setups. It is ideal for modern, fast-paced development, new projects, and deployment environments like Vercel.

Guide for assessing AWS, Azure, and GCP environments with tools such as Pacu, ScoutSuite, and Prowler to uncover IAM weaknesses, exposed storage, insecure serverless functions, and cloud-native attack chains.

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.

A comprehensive toolkit designed for cybersecurity professionals to deobfuscate malicious JavaScript code. It reverses complex encoding layers (Base64, Hex, Unicode), eval chains, and control flow obfuscation techniques found in phishing pages, web skimmers, and dropper scripts, revealing the original malicious logic for thorough forensic analysis and threat intelligence gathering.

This tool scans GitHub Actions workflows and CI/CD configurations to identify critical supply chain attack vectors. It specifically checks for unpinned actions, risks from script injection using expressions, dependency confusion, and secrets exposure, helping organizations harden their build systems against sophisticated threats.

A comprehensive guide for discovering and exploiting broken link hijacking vulnerabilities. This skill focuses on identifying references to expired domains, decommissioned cloud resources (like S3 buckets), and dead external services. It covers advanced techniques such as subdomain takeover, supply chain security assessment, and resource claiming for authorized penetration testing.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

Learn how to implement robust container security by integrating the open-source Trivy scanner (from Aqua Security) into your CI/CD pipelines. This guide covers scanning container images, Kubernetes manifests, IaC files, and code repositories to detect critical vulnerabilities, misconfigurations, secrets, and generating Software Bill of Materials (SBOM) for comprehensive supply chain security.

This skill guides implementing robust code signing for software artifacts (binaries, packages, containers). It ensures integrity and authenticity throughout the entire software supply chain. Learn to use traditional methods like GPG and modern, keyless approaches like Sigstore (cosign) to establish trust chains, verify provenance, and meet compliance standards (e.g., SLSA).

This guide details how to use Google Distroless images to drastically reduce the attack surface of containerized applications. By eliminating shells, package managers, and unnecessary OS utilities, these minimal base images enhance security, align with compliance standards, and improve supply chain security in Kubernetes and Docker deployments. It provides multi-stage build patterns for various languages (Go, Java, Python, Node.js).

Breach and Attack Simulation (BAS) provides an automated, continuous method for validating the effectiveness of security controls (EDR, SIEM, NGFW, etc.). By safely emulating real-world attack techniques mapped to the MITRE ATT&CK framework, BAS helps organizations proactively identify security gaps and measure control maturity across the entire kill chain. It moves beyond point-in-time testing to provide an ongoing security posture assessment.