Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

Master the complete penetration testing lifecycle, covering all five stages from reconnaissance and scanning to vulnerability analysis using OWASP standards, and advanced exploitation techniques with tools like Metasploit. This skill provides a structured framework for conducting authorized, professional security assessments.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

A comprehensive framework for assessing network security posture. This skill guides the tester through the entire penetration testing lifecycle, from reconnaissance and host discovery (using tools like Nmap) to service enumeration, vulnerability identification (CVEs), and controlled exploitation (Metasploit). It is essential for validating firewall rules, ensuring compliance (e.g., PCI-DSS), and stress-testing critical infrastructure security.

Pass-the-Ticket (PtT) is a critical post-exploitation technique used in red teaming and offensive security assessments. It allows an attacker to move laterally across a network by utilizing stolen Kerberos tickets (TGT or TGS) without ever needing the user's password. This skill outlines the process of dumping tickets from memory (e.g., LSASS) and injecting them into a current session to impersonate a high-privilege user for access to sensitive resources.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

This comprehensive guide outlines methods to identify and exploit specific IPv6 vulnerabilities, including SLAAC spoofing, Router Advertisement (RA) manipulation, and Neighbor Discovery Protocol (NDP) attacks. It is designed strictly for authorized penetration testing to assess dual-stack security controls, detect unauthorized tunnels (like Teredo or 6to4), and validate network defenses against IPv6-specific threats. Always obtain explicit written authorization before use.

A comprehensive guide for authorized penetration testing, demonstrating how to identify and exploit critical vulnerabilities in the SMB protocol (e.g., EternalBlue, PrintNightmare). This skill covers network enumeration, lateral movement techniques (Pass-the-Hash, SMB Relay), and post-exploitation activities using Metasploit and Impacket tools to assess enterprise network security posture.

The Metasploit Framework is the industry standard platform for penetration testing and vulnerability validation. It provides numerous modules (exploits, payloads, auxiliaries) used to confirm if identified security weaknesses are genuinely exploitable. This guide details using Metasploit in a structured, risk-based workflow for authorized testing, including vulnerability checking, post-exploitation assessment, and patch verification.

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.