Skill UI

Master systematic methodologies for using Shodan to perform deep reconnaissance during penetration testing. This skill covers querying exposed services, mapping assets, identifying vulnerable systems (CVEs), and utilizing advanced filters for IP ranges, geographical locations, and organizational data. Ideal for security researchers and ethical hackers.

This comprehensive guide details the use of FFUF, a fast web fuzzer written in Go. It is designed for advanced security penetration testing, providing techniques for content discovery, subdomain enumeration, parameter fuzzing, and POST data testing. Learn to master the FUZZ keyword, advanced filtering, and auto-calibration to efficiently identify hidden paths and potential vulnerabilities in web applications.

A comprehensive guide for deep packet inspection and network forensics using Wireshark and tshark. This skill is critical for incident response, where it allows users to capture, filter, and analyze network packet data to identify malicious command-and-control traffic, diagnose complex protocol issues, extract indicators of compromise (IOCs), and reconstruct data exfiltration paths. Use it for validating security rules and understanding network anomalies.

This guide provides comprehensive techniques for detecting Layer 2 ARP poisoning and spoofing attacks. It covers monitoring gratuitous ARP floods, tracking IP-to-MAC mapping changes, and identifying rogue devices. Techniques include deploying ARPWatch, configuring Dynamic ARP Inspection (DAI) on managed switches, and using advanced Wireshark filters or custom Python scripts for robust security monitoring and incident response.

This guide details advanced methods for detecting and preventing QR code phishing (quishing) attacks. It covers how malicious URLs embedded in images bypass traditional email security filters, requiring multimodal AI, OCR, and robust mobile threat defense solutions. Essential for SOC analysts and security teams.

This skill guides the setup of a robust, centralized logging pipeline using Fluent Bit and Fluentd. It covers collecting logs from diverse sources (syslog, files, applications), routing, filtering, and enriching them before sending them to destinations like Elasticsearch, S3, or Splunk. Ideal for centralizing observability and building secure logging architectures across distributed infrastructure.

Configure NextDNS as an encrypted DNS resolver (DoH/DoT) to enforce zero trust principles at the network layer. This skill guides users on deploying real-time threat intelligence filtering, blocking malicious domains, preventing cryptojacking, detecting DNS rebinding, and enforcing strict organizational DNS policies across endpoints, aligning with modern cybersecurity standards.

A comprehensive guide to investigating AWS account compromises by querying CloudTrail logs. Use boto3 or AWS Athena to filter suspicious activities—such as unauthorized API calls, S3 data exfiltration, or IAM privilege escalation—to reconstruct a detailed attacker timeline and generate a professional forensic report.

This skill demonstrates how to secure AWS API Gateway endpoints using AWS WAF (Web Application Firewall). It implements essential security measures including protection against OWASP Top 10 vulnerabilities, custom rate-limiting rules, IP reputation filtering, and bot control. Ideal for deploying public API endpoints that require robust defense against common web attacks and API abuse.

This guide provides a comprehensive framework for investigating production issues on the Nexu platform using the Datadog Logs API. It details how to query crash events, analyze OpenClaw stderr output, check gateway startup status, and review API request logs (including 5xx errors). It includes best practices for authentication, filtering by pod/time, and parsing raw JSON logs using Python for actionable insights.

A comprehensive playbook detailing expert techniques to escape multiple types of restricted environments, including Python pyjail, Docker containers, seccomp filters, and browser rendering processes. It covers advanced exploitation vectors like namespace escapes, kernel exploits, and built-in function bypasses for achieving code execution.

Configure iptables, nftables, UFW, and cloud firewalls with default-deny policies, network segmentation, traffic filtering, and safe rule rollback for perimeter security.