Skill UI

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

Use RESTler to automate stateful security testing of REST APIs. It processes OpenAPI specifications to generate fuzzing grammars, allowing users to discover complex bugs, such as injection vulnerabilities, resource leaks, and unhandled exceptions (500 errors), by executing diverse sequences of API calls. Essential for robust CI/CD regression testing and proactive API security assessments.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This guide details how to simulate ARP spoofing attacks in controlled, authorized lab environments. It demonstrates Man-in-the-Middle (MITM) risks by poisoning the ARP cache, allowing users to test network detection capabilities (IDS/IPS, DAI) and validate the effectiveness of security controls like port security and 802.1X. This skill is strictly for authorized penetration testing and educational purposes.

This guide details how to use OpenVAS/Greenbone Vulnerability Management (GVM) to perform authenticated vulnerability scans. By utilizing valid credentials (SSH for Linux, SMB for Windows), scans can log into target systems, detecting deep local vulnerabilities, missing patches, and misconfigurations far beyond what unauthenticated scans can find. This is essential for comprehensive security assessments and compliance auditing.

This guide details authenticated (credentialed) vulnerability scanning, which uses valid system credentials (SSH keys, domain passwords, etc.) to log into target hosts. Unlike external scanning, credentialed methods allow deep inspection of installed patches, local configurations, registry keys, and system files across diverse platforms (Linux, Windows, Network Devices). This significantly increases vulnerability detection rates and reduces false positives for comprehensive security assessments.

This skill simulates various network attack scenarios, including bandwidth throttling, traffic shaping, and network degradation, using tools like tc, iperf3, and Scapy. It is designed for authorized security assessments to test the resilience of applications, validate Quality-of-Service (QoS) policies, and assess the ability of network monitoring tools to detect sophisticated traffic manipulation attacks (e.g., Slowloris-style attacks).

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.

This skill assesses Bluetooth Low Energy (BLE) device security by scanning nearby devices, enumerating GATT services, and analyzing characteristics. It detects critical vulnerabilities such as unencrypted sensitive data exposure, weak pairing configurations, and known vulnerable device fingerprints, making it essential for IoT and medical device security auditing.

A comprehensive tool for auditing container security posture by detecting potential escape vectors. It analyzes Kubernetes Pod specs for dangerous configurations, such as running in privileged mode, dangerous capability assignments (like CAP_SYS_ADMIN), host namespace sharing, and writable hostPath mounts. Ideal for security assessments and incident response to prevent container breakout.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

A comprehensive guide for analyzing firmware images from embedded systems, IoT devices, routers, and specialized components like UEFI/BIOS. This skill covers advanced techniques including filesystem extraction, binary reverse engineering (using Ghidra/IDA), rootkit detection, and deep forensic analysis to uncover backdoors, implants, and supply chain compromises. Essential for cybersecurity professionals investigating compromised hardware.