Skill UI

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

This comprehensive guide teaches advanced iOS reverse engineering techniques using Frida dynamic instrumentation. Users can analyze proprietary app logic, extract encryption keys, trace method calls, and bypass anti-tampering or anti-debugging mechanisms without needing source code. It is essential for authorized mobile security testing and protocol analysis.

This comprehensive skill provides a systematic framework for performing deep security assessments on iOS applications. It covers static analysis of IPA packages, dynamic instrumentation using Frida and Objection, SSL pinning bypass for traffic interception, extraction and auditing of sensitive data from the Keychain, and runtime method hooking. Use this for authorized penetration testing against standards like OWASP MASTG.

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

This guide outlines the methodology for conducting hardware security research on embedded systems. It covers physical interface analysis (UART, JTAG, SWD), debug pad triage, secure boot evaluation, and offline firmware extraction. It emphasizes systematic, non-destructive testing protocols and responsible handling of physical devices.

A specialized downstream skill designed for solving encrypted ZIP/PKZIP challenges, particularly those using the legacy ZipCrypto method in CTF competitions. This workflow utilizes known-plaintext attacks (via tools like bkcrack) to recover internal encryption keys, enabling decryption and extraction without resorting to brute-force password guessing. Use this when a predictable plaintext fixture is available.