Skill UI

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide outlines the process of passive external reconnaissance using Open Source Intelligence (OSINT) techniques. Users can map an organization's digital footprint by gathering comprehensive data, including DNS records, subdomains, certificate transparency logs, social media profiles, and leaked credentials. It is critical for the planning phase of penetration testing, asset mapping, or preparing for social engineering, all without actively interacting with target systems.

This tool discovers and inventories 'shadow APIs'—endpoints that operate outside documented specifications (OpenAPI/Swagger). It utilizes advanced traffic analysis against API gateways (e.g., Kong, AWS API Gateway), cloud configuration scanning, and source code mining. Essential for assessing the complete API attack surface, auditing forgotten services, or establishing robust API governance policies.

Utilize Velociraptor, an advanced open-source platform, to collect, query, and monitor forensic artifacts across diverse endpoints (Windows, Linux, macOS). This skill enables incident response teams to perform large-scale, rapid digital forensic investigations by collecting critical data such as event logs, registry entries, prefetch files, and network metadata using VQL queries.

ScoutSuite is an open-source, agentless tool designed for comprehensive AWS security posture assessment. It queries AWS APIs to automatically enumerate resources across various services, identify critical misconfigurations (like public S3 buckets or overly permissive IAM roles), and generate an interactive HTML report. It is ideal for conducting cloud security audits, compliance checks, or incident response procedures using read-only credentials.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This tool automates the security audit of Docker environments using the open-source CIS Docker Benchmark. It assesses host configuration, daemon settings, container images, and runtime controls, generating a comprehensive pass/fail/warn compliance report. It is essential for ensuring CIS compliance, validating security hardening, and automating scheduled container security testing.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.