Skill UI

Provides step-by-step techniques for assessing AWS security, covering IAM enumeration, privilege escalation, SSRF metadata attacks, S3/Lambda exploitation, and red-team persistence workflows with recommended tools and commands.

Enables structured cloud penetration testing across Azure, AWS, and GCP by guiding reconnaissance, authentication, enumeration, exploitation, and persistence workflows for authorized assessments.

Guides learners through reconnaissance, scanning, vulnerability analysis, exploitation, and reporting phases of authorized penetration testing, pairing command examples with tool choices and professional deliverables.

Guides security teams through using Metasploit’s console, modules, payloads, and Meterpreter workflow for authorized penetration tests and post-exploitation procedures.

Guides configuring HTTP/HTTPS, SNMP, and SMB services plus verification and log review for penetration testing labs using Windows or Linux hosts.

Structured checklist guiding the planning, scoping, environment prep, tester selection, and reporting phases of penetration tests to keep security assessments thorough and compliant.

Provides quick reference to penetration testing commands for network scanning, exploitation, password cracking, and web testing workflows, helping security professionals run tools like Nmap, Metasploit, Nikto, and SQLMap during assessments.

A comprehensive guide covering advanced exploitation techniques for insecure deserialization vulnerabilities across multiple languages (Java, PHP, Python, .NET, Node.js). It details how to enumerate data sinks (cookies, message queues), fingerprint various serialization formats (e.g., Pickle, Marshal, JSON.NET), and construct complex gadget chains using tools like ysoserial. This is essential for penetration testers reviewing applications that process untrusted serialized input.

This comprehensive checklist provides a deep dive into Endpoint Detection and Response (EDR) architecture and monitoring mechanisms. It details advanced evasion techniques, such as direct syscalls, AMSI bypass, kernel patching, and memory manipulation. This skill is essential for red team engagements, penetration testing, and advanced malware research to thoroughly assess and bypass modern security defenses.

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

A comprehensive methodology for conducting deep security assessments and penetration tests against GraphQL APIs. This guide covers the entire attack lifecycle, including endpoint discovery, blind schema reconstruction, authentication/authorization bypass, SQL/NoSQL injection, Denial of Service (DoS) via depth bombs, and abusing advanced features like file uploads and subscriptions. It provides actionable steps and tool guidance for professional security researchers and ethical hackers.

This comprehensive checklist guides penetration testers through discovering Insecure Direct Object References (IDOR). It covers techniques like object ID enumeration, horizontal and vertical privilege escalation, and parameter manipulation. Use it for web application pentests and bug bounty hunting to identify broken access control vulnerabilities.