Skill UI

Master the complete penetration testing lifecycle, covering all five stages from reconnaissance and scanning to vulnerability analysis using OWASP standards, and advanced exploitation techniques with tools like Metasploit. This skill provides a structured framework for conducting authorized, professional security assessments.

This skill details the process of reverse engineering Go-compiled malware using Ghidra. It involves parsing Go-specific metadata structures like buildinfo and pclntab to recover stripped or obfuscated function names. Users can also extract embedded module paths and dependency strings, providing critical insight into the malware's capabilities and third-party dependencies.

This skill details advanced digital forensics techniques for recovering metadata and content of deleted files by analyzing the NTFS Master File Table ($MFT). It covers examining key system artifacts like $LogFile and $UsnJrnl, and analyzing MFT slack space. Use this when reconstructing file system timelines, investigating data loss, or detecting anti-forensic techniques like timestomping during a Windows forensic examination.

A comprehensive framework for assessing network security posture. This skill guides the tester through the entire penetration testing lifecycle, from reconnaissance and host discovery (using tools like Nmap) to service enumeration, vulnerability identification (CVEs), and controlled exploitation (Metasploit). It is essential for validating firewall rules, ensuring compliance (e.g., PCI-DSS), and stress-testing critical infrastructure security.

A comprehensive guide for authorized penetration testing, demonstrating how to identify and exploit critical vulnerabilities in the SMB protocol (e.g., EternalBlue, PrintNightmare). This skill covers network enumeration, lateral movement techniques (Pass-the-Hash, SMB Relay), and post-exploitation activities using Metasploit and Impacket tools to assess enterprise network security posture.

A comprehensive guide to using the Metasploit Framework for advanced penetration testing and vulnerability validation. This skill details how to confirm exploitability of identified CVEs, gather post-exploitation evidence, and validate patch remediation effectiveness. It is essential for risk-based vulnerability management and red team exercises, providing proof of real-world impact beyond simple scanner scores.

This skill detects persistence mechanisms by monitoring Windows startup directories for suspicious file creation (T1547.001). It utilizes real-time file system monitoring via Python watchdog, cross-references Autoruns entries, and analyzes file metadata to identify implants that survive system reboots. Essential for threat hunting and validating security monitoring coverage.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

Designed for complex troubleshooting in home or small-team environments. This meta-skill orchestrates the entire process, guiding users through symptom intake, environment capture, external knowledge lookup, and generating a safe, step-by-step, and reversible repair plan for issues involving networks, Docker, Git, printers, and more.

This specialized skill is designed for advanced security analysis, tracing the complete trust chain from cloud metadata services to accepted privilege. It is used in penetration testing or CTF environments to meticulously prove how metadata-derived credentials (such as instance identities or tokens) are issued and subsequently accepted by a cloud or control plane API, thereby exposing the decisive trust edge.

This advanced skill specializes in detecting and recovering hidden data (steganography) embedded within various media containers, including images, audio, video, and documents. It is crucial for forensic analysis and CTF challenges, allowing users to inspect metadata, LSBs, alpha/palette channels, and appended trailers to reconstruct hidden payloads without brute force.