Skill UI

A comprehensive guide for statically analyzing suspicious Android APKs. This skill demonstrates how to use JADX, apktool, and androguard to decompile Java/Kotlin source code, examine manifest permissions, and identify malicious patterns. Use this to detect data exfiltration, C2 command and control communication, privilege escalation, and overlay attacks in mobile threats.

A comprehensive guide for reversing and analyzing .NET malware samples. Learn the full workflow, including identifying .NET assemblies, using de4dot to deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and loading the cleaned code into dnSpy. This skill is essential for extracting hardcoded C2 configurations, encryption keys, and credentials, and debugging runtime behaviors of complex malware.

This comprehensive guide details a step-by-step workflow for reverse engineering malware binaries using Ghidra. It guides users through static and dynamic analysis techniques to study internal logic, C2 communication protocols, cryptographic routines, and obfuscation methods at the assembly and pseudo-C code level. Use this when deep code review is required to extract configuration data, understand exploit mechanisms, or develop detection signatures.

This skill provides comprehensive integration for TP-Link Tapo cameras (models like C200, C310, etc.). It supports streaming via RTSP and ONVIF protocols, allowing users to discover cameras on the network, capture motion-triggered video clips, and maintain stable live video feeds. Setup requires basic network credentials and Python environment setup.

A comprehensive guide detailing best practices for securing MindTickle integrations. It covers critical technical requirements including using `Company-Id` for multi-tenant isolation, implementing HMAC-SHA256 verification for webhooks, strict SCIM payload validation, and PII redaction. Essential for developers ensuring compliance with GDPR and SOC2 standards when handling sensitive employee and HR data.

A comprehensive playbook detailing advanced techniques for exploiting glibc heap vulnerabilities using ptmalloc2. Covers various memory corruption primitives, including Use-After-Free, double free, and overflows. Provides version-specific guidance on bypassing modern protections like safe-linking (glibc >= 2.32) and RCE methods for post-2.34 environments.

This workflow systematically analyzes deployed AWS resources and Infrastructure-as-Code (IaC) definitions. It collects usage metrics from CloudWatch and Cost Explorer to identify over-provisioning, unused resources, and inefficient configurations (e.g., right-sizing EC2, S3 lifecycle policies). It generates actionable cost optimization recommendations and creates structured GitHub issues for tracking and implementing savings.

This skill allows users to query the current state of various AWS resources (including EC2, S3, Lambda, RDS, VPC, etc.) using natural language. It translates user intent into strictly read-only AWS CLI commands (e.g., `describe-*`, `list-*`). Crucially, this tool can only view data and is contractually incapable of performing any write, modify, delete, or mutation actions, ensuring maximum safety.

A comprehensive tool designed to discover and map adversary-controlled assets, including C2 servers, phishing domains, and exploit kits. It utilizes sophisticated pivoting techniques across passive DNS records, Certificate Transparency logs, Shodan/Censys scans, and network fingerprints (JARM/JA3S) to generate actionable threat intelligence, perfect for CTI investigations and security operations.

This guide details setting up advanced Command and Control (C2) redirectors, acting as protective intermediaries between implant beacons and the hidden team server. It covers using Nginx and Apache for request filtering based on Malleable C2 profiles, layering Let's Encrypt TLS, and implementing advanced OPSEC controls like domain fronting, geo/UA filtering, and decoy diversion. Essential for red-teaming operations requiring high resilience against blue-team detection and takedown.

Sliver is an open-source, cross-platform Command and Control (C2) framework used for adversary emulation in authorized red-team engagements. This skill guides users through deploying the C2 server, establishing multi-protocol listeners (mTLS, DNS, HTTPS), generating cross-platform implants, and executing advanced post-exploitation techniques, including pivoting and in-memory execution via the Armory.