Skill UI

This skill guides the integration of OWASP ZAP for Dynamic Application Security Testing (DAST) directly into CI/CD pipelines. Learn how to perform baseline, full, and API scans against running applications, interpret complex security findings, tune scan policies, and establish automated security quality gates in modern CI/CD platforms like GitHub Actions and GitLab CI. Essential for DevSecOps practices.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This tool simulates advanced security testing to identify vulnerabilities in API rate limiting. It bypasses throttling controls by manipulating request headers (like X-Forwarded-For spoofing), varying source IP addresses, and manipulating endpoint paths. Essential for assessing API resilience against brute-force attacks, credential stuffing, and resource exhaustion, aligning with OWASP API Security guidelines.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

Cartography is a CNCF project designed to perform comprehensive cloud asset inventory across AWS, GCP, and Azure. It queries cloud APIs to aggregate infrastructure resources, map complex relationships (like IAM permissions and network paths), and store them in a Neo4j graph database. This allows security teams to visualize potential attack paths, conduct deep security audits, and identify cross-cloud misconfigurations.

This skill provides methods for comprehensive forensic acquisition of data from major cloud services, including Google Drive, OneDrive, Dropbox, and Box. It collects evidence through both API-based remote acquisition and local endpoint artifact analysis, making it essential for incident response, security assessments, and digital forensic investigations.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

This skill utilizes the Shodan API to perform comprehensive IP reputation analysis. It enriches IP addresses by identifying open ports, running services, known vulnerabilities (CVEs), and hosting context. It is crucial for threat intelligence enrichment, incident triage, and security assessments, helping security professionals assess the risk level and potential compromise of exposed infrastructure.

This tool automates the process of executing the JWT none algorithm attack. It demonstrates how to bypass signature verification by setting the 'alg' header to 'none' in a JSON Web Token. This vulnerability allows attackers to forge tokens with arbitrary claims, such as escalating privileges or impersonating other users, and is crucial for penetration testing and API security auditing.

This comprehensive skill guides the process of rapid malware triage and classification using YARA rules. It covers advanced techniques for writing detection rules based on unique strings, specific byte sequences, and structural PE characteristics. It is essential for security analysts building automated detection pipelines, scanning endpoints, or performing large-scale threat hunting across an enterprise environment.