Skill UI

A guided workflow for auditing AWS Lambda, Azure Functions, and GCP Cloud Functions to catch permissive execution roles, exposed secrets, and missing runtime protections before deployment.

Automates scheduled rotation of service account credentials across AD, cloud IAM, and application stores, updating all consumers, verifying health, and retiring old secrets to reduce compromise risk.

Guides SOC teams through discussion-based tabletop exercises that simulate security incidents, validate IR playbooks, train analysts, and rehearse cross-functional communication so you can test procedures without touching production systems.

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

Simulates SSL stripping with sslstrip, Bettercap, and mitmproxy to verify HSTS enforcement, TLS validation, and HTTPS upgrades in authorized assessments, helping teams confirm detection and response to encrypted connection downgrades.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.

Use ProjectDiscovery’s Subfinder to passively enumerate target domains’ subdomains, configure API sources, and stream results to httpx/dnsx/nuclei for validation, rate control, and attack-surface mapping during penetration tests or bug bounty reconnaissance.

Simulates and detects software supply chain attacks by checking typosquatting risks with Levenshtein distance, probing dependency confusion across registries, verifying package hashes, and running pip-audit vulnerability scans for security assessments.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

Performs proactive threat hunting inside Elastic Security SIEM by crafting KQL/EQL hunting queries, translating findings into detection rules, and using Timelines to investigate anomalies that evade automated alerts.

This skill guides the programmatic creation, enrichment, and secure sharing of threat intelligence within a MISP platform. Using the official PyMISP Python library, users can manage Indicators of Compromise (IOCs), apply MITRE ATT&CK tags, configure sharing groups, and export structured data in STIX 2.1 format. It is essential for security assessments, incident response, and automated threat intelligence pipelines.

Performs UEBA-driven anomaly detection in SIEM environments to flag impossible travel, privilege abuse, anomalous timing, and data access deviations so SOC teams can investigate compromised accounts or insider threats.