Skill UI

A comprehensive guide for authorized red-team assessments using the Pacu framework. This process details how to enumerate IAM policies, scan for privilege escalation paths, test data access across services (S3, DynamoDB), and simulate lateral movement to determine the blast radius of compromised AWS credentials.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This tool automates the security audit of Docker environments using the open-source CIS Docker Benchmark. It assesses host configuration, daemon settings, container images, and runtime controls, generating a comprehensive pass/fail/warn compliance report. It is essential for ensuring CIS compliance, validating security hardening, and automating scheduled container security testing.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.

This skill teaches authorized users how to perform comprehensive password hash cracking using Hashcat. It covers various attack methodologies, including dictionary, brute-force, and rule-based attacks, and identification of common hash types (e.g., MD5, NTLM, bcrypt). The primary use case is for conducting controlled security assessments and penetration testing to evaluate password strength and compliance with current security policies. Always used under explicit authorization.

Provides a comprehensive guide to auditing the security posture of the etcd cluster, the critical key-value store backing Kubernetes. This assessment covers encryption at rest for secrets, TLS transport security, access control policies, secure backup procedures, and network isolation best practices. Essential for hardening control planes and ensuring regulatory compliance.

A comprehensive guide to systematically evaluating Kubernetes cluster security by simulating advanced attacker techniques. It covers attacking the API server, kubelet, etcd, RBAC, and secrets using specialized tools like kube-hunter, Kubescape, and peirates. Essential for authorized security assessments and hands-on validation of cluster defenses.

A comprehensive assessment tool for the cybersecurity posture of oil and gas critical infrastructure. It covers upstream, midstream, and downstream facilities, evaluating SCADA, DCS, and SIS systems against industry standards like API 1164, IEC 62443, and TSA directives. Ideal for preparing for regulatory compliance audits and identifying security gaps in industrial control systems.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.