Skill UI

A comprehensive guide featuring best practices and patterns for building robust GitLab CI/CD pipelines. Covers multi-stage deployments, containerization (Docker), infrastructure as code (Terraform), security scanning, caching strategies, and advanced GitOps workflows for automated testing and deployment to Kubernetes.

This tool discovers and inventories 'shadow APIs'—endpoints that operate outside documented specifications (OpenAPI/Swagger). It utilizes advanced traffic analysis against API gateways (e.g., Kong, AWS API Gateway), cloud configuration scanning, and source code mining. Essential for assessing the complete API attack surface, auditing forgotten services, or establishing robust API governance policies.

Leverage the in-toto framework to enforce software supply chain integrity for container builds. This method generates cryptographically signed attestations (link metadata) at every stage—from code checkout to scanning—verifying that the deployed container image followed a predefined and approved build process. It is essential for implementing robust security controls, especially when requiring verifiable provenance before deployment in Kubernetes environments.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.