Skill UI

This guide details advanced techniques for authorized security assessments, focusing on forced browsing. It helps testers discover hidden administrative pages, unprotected APIs, and configuration files by systematically enumerating URLs and challenging application access control mechanisms. Techniques involve using tools like ffuf and Gobuster for comprehensive path and directory discovery.

This skill automates the process of testing for Broken Function Level Authorization (BFLA) vulnerabilities in APIs. It simulates attempts by low-privilege users to access or execute administrative functions and privileged endpoints by manipulating HTTP methods, paths, and credentials. It is essential for comprehensive API security audits and validating Role-Based Access Control (RBAC) enforcement.

A detailed guide on discovering and exploiting Mass Assignment vulnerabilities in REST APIs. Users learn to inject unexpected parameters into API requests (POST, PUT, PATCH) to bypass authorization controls, escalate privileges (e.g., changing 'role'), and modify sensitive fields (e.g., 'balance', 'isAdmin') during security assessments and bug bounty hunting.

This skill guides threat hunters in detecting MITRE ATT&CK T1098 account manipulation techniques. It focuses on analyzing Windows Security Event Logs (like 4738, 4728) to uncover shadow administration creation, suspicious group membership changes, SID history injection, and unauthorized credential modifications, crucial for incident response and building robust detection rules.

This comprehensive guide details how to implement Single Sign-On (SSO) for Google Workspace using the SAML 2.0 protocol. It guides administrators through connecting a third-party Identity Provider (IdP) like Okta or Azure AD to centralize authentication, enforce MFA, and manage access policies across the organization.

This skill provides a comprehensive guide for designing and deploying Privileged Access Workstations (PAWs). It covers critical security controls such as device hardening, Zero Trust principles, and integrating Just-in-Time (JIT) access management. Learn how to enforce compliance using tools like Intune/GPO and secure credentials using leading PAM platforms like CyberArk or BeyondTrust, ensuring secure administrative operations.

A comprehensive guide to securing Kubernetes Role-Based Access Control (RBAC). It teaches best practices for implementing least-privilege policies, eliminating excessive cluster-admin bindings, utilizing namespace-scoped roles, and integrating external identity providers (OIDC) to mitigate risks like privilege escalation and unauthorized data access.

A comprehensive guide for deploying, configuring, and maintaining the OpenViking server in production environments. It covers service configuration management, environment setup using `uv` for virtual environments, reliable startup procedures using `nohup`, graceful shutdown methods, and critical data cleanup workflows. This resource is essential for DevOps engineers and system administrators managing OpenViking services.

Persona for IT administrators to monitor Workspace security, configure Drive sharing policies, and run workflows for standup reporting and audit review while emphasizing dry-run checks and auth-status verification.

A comprehensive toolkit for automating various Discord operations, including sending messages (DMs and channels), managing user roles, creating and executing webhooks, and controlling message reactions. It utilizes Rube MCP and dedicated `discord` and `discordbot` toolkits, providing deep programmatic control over Discord interactions and administrative tasks.

Automate Intercom customer-communication workflows via Composio’s Rube MCP toolkit, letting you list, search, reply, assign, close, and manage conversations plus contacts, admins, segments, and companies after fetching current tool schemas and confirming an active Intercom connection.

A comprehensive guide for integrating the Algolia JavaScript v5 client into Node.js/TypeScript projects. It covers proper installation, secure management of Application IDs and API keys (Admin vs. Search-Only), and best practices for client initialization, ensuring robust and safe search functionality implementation.