Skill UI

This skill automates the execution of red team phishing campaigns using the Python gophish library. It enables users to create sophisticated email templates with tracking pixels, configure SMTP profiles, import target lists from CSV, and launch full-scale simulations. The system tracks key metrics, including open rates, click rates, and submitted credentials, providing essential data for security awareness training and vulnerability assessments.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

Implements end-to-end FIDO2/WebAuthn hardware security key authentication, covering server configuration, registration and authentication ceremonies, YubiKey enrollment, and passkey migration so high-value accounts gain phishing-resistant, passwordless MFA.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.