Skill UI

A comprehensive guide for assessing the security of JSON Web Token (JWT) implementations. This toolkit details attacks against cryptographic weaknesses, including algorithm confusion (e.g., RS256 to HS256), 'none' attacks, brute-forcing HMAC secrets, and claim manipulation. Ideal for penetration testing and security audits of modern APIs and SSO systems.

A comprehensive guide and framework for assessing real-time WebSocket APIs (ws:// or wss://). This skill covers critical security checks, including Cross-Site WebSocket Hijacking (CSWSH), authentication bypass, message injection attacks, input validation flaws, and denial-of-service (DoS) via message flooding. It utilizes tools like Burp Suite and Python for simulating malicious payloads and ensuring secure real-time communication channels.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

This guide details implementing an IEC 62443 compliant conduit architecture for secure remote access into Operational Technology (OT) environments. It mandates the use of jump servers, MFA gateways, session recording, and approval workflows within a DMZ to strictly control vendor and engineer access, eliminating direct VPN connections to critical ICS assets.

This tool provides a structured methodology for assessing the security posture of SCADA Human-Machine Interface (HMI) systems. It evaluates potential vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication pathways between HMIs and PLCs, ensuring compliance alignment with rigorous standards like IEC 62443 and NIST SP 800-82.

A comprehensive framework for advanced forensic analysis of UEFI firmware and boot process integrity. It details methods to detect firmware implants in SPI flash, audit UEFI variables (PK, KEK, DB), inspect the EFI System Partition (ESP) for unauthorized components, and analyze boot chain anomalies. Ideal for investigating advanced persistent threats (APTs) and verifying system security posture against rootkits and bootkit techniques.

This tool monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance for owned domains, discover hidden subdomains, and track suspicious certificate activity. By querying public CT logs and APIs (like crt.sh), it helps build continuous security pipelines, identify potential phishing infrastructure, and map the external attack surface for comprehensive threat intelligence.

A comprehensive guide to building a structured incident response playbook for ransomware attacks. It aligns with the CISA StopRansomware Guide and NIST CSF, covering all phases from preparation and detection to containment, eradication, and recovery. Ideal for security teams conducting readiness assessments or updating compliance documentation.

A comprehensive knowledge-base-first skill designed for deep literature reviews in advanced communication domains. Use it for topics like 4G/5G/6G, wireless networking, satellite communications, Wi-Fi, routing protocols, and cross-layer optimization. It systematically searches structured academic databases (IEEE, ACM, Zotero, etc.) to provide related work, survey papers, and landscape summaries.

This skill outlines the architecture and methodology for deploying canary files (honeytokens) across critical file systems. By placing decoy documents with known content in high-value locations, this system monitors for unauthorized modifications, deletions, or encryption attempts. It detects ransomware by triggering high-fidelity alerts via File Integrity Monitoring (FIM) systems, serving as a crucial deception layer that complements existing EDR/AV solutions.