Skill UI

This skill guides comprehensive Google Cloud Platform (GCP) security auditing. It uses GCPBucketBrute for enumerating storage buckets and testing access permissions. Furthermore, it analyzes gcloud IAM bindings to detect overly permissive roles, identify service account key exposure, and map potential privilege escalation paths, ensuring robust security assessment for cloud environments.

Perform comprehensive security assessments for Google Cloud Platform environments. This tool audits critical security components—including IAM policies, firewall rules, and storage permissions—against industry benchmarks like the CIS GCP Foundations Benchmark. It helps organizations establish secure baselines and ensure continuous compliance across multiple GCP projects.

This skill automates GraphQL introspection to extract the complete API schema, including types, queries, mutations, and subscriptions. It is designed to map the entire attack surface, helping authorized testers identify sensitive endpoints and test for vulnerabilities such as query depth abuse, batching attacks, and resource exhaustion. Ideal for comprehensive API security assessment.

A comprehensive guide for performing authorized security assessments on GraphQL APIs. This skill covers key areas such as endpoint discovery, schema introspection, testing for authorization flaws (BOLA/BFLA), injection vulnerabilities (SQL/NoSQL), and denial-of-service risks. Essential for penetration testers and bug bounty researchers targeting modern web applications.

This skill demonstrates how to integrate Hardware Security Modules (HSMs) using the standard PKCS#11 interface. It covers secure key generation, signing, encryption, and verification operations directly on the hardware. Ideal for security assessments, compliance audits (FIPS 140-2/3), and validating cryptographic controls using tools like python-pkcs11, AWS CloudHSM, and YubiHSM2.

This tool provides comprehensive asset discovery and inventory management for Operational Technology (OT) and Industrial Control Systems (ICS) environments using the Claroty xDome platform. It utilizes passive monitoring and active querying to achieve full visibility into critical assets across Purdue Model levels, including PLCs, RTUs, and HMIs. Ideal for compliance assessments (e.g., IEC 62443) and onboarding brownfield sites.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

A comprehensive security auditing tool designed to assess a Kubernetes cluster's compliance posture against established CIS benchmarks. It performs deep checks on control plane components (API Server, etcd, Controller Manager), worker nodes, and Role-Based Access Control (RBAC). Use it for proactive security assessments, compliance validation, and hardening throughout the CI/CD lifecycle.

This guide provides a comprehensive methodology for assessing the security posture of Kubernetes etcd clusters. It covers critical areas including encryption at rest (for secrets), TLS transport security, access control validation, secure backup procedures, and network isolation checks, ensuring cluster data integrity and confidentiality.

A comprehensive guide for systematically evaluating Kubernetes cluster security. It simulates advanced attacker techniques against critical components like the API server, etcd, kubelet, RBAC, and network policies, identifying misconfigurations and vulnerabilities. Essential for security auditors, penetration testers, and DevOps teams performing deep cluster security assessments.

This guide details the comprehensive process of onboarding new log sources into Security Information and Event Management (SIEM) platforms. It covers critical steps including data source discovery, configuring collectors (e.g., Syslog, Splunk UF, CloudTrail), building parsers, normalizing fields to a common schema, and validating data quality. This systematic approach is essential for achieving complete security visibility and effective threat detection across the enterprise.

A comprehensive guide for digital forensics professionals on analyzing volatile memory dumps using Volatility 3. Learn to extract critical evidence, including running processes, network connections, loaded DLLs, system credentials, and detecting advanced threats like process hollowing and rootkits. Essential for incident response and malware analysis.