Skill UI

This skill provides comprehensive guidance on establishing secure, high-performance connectivity between on-premises data centers and major public cloud providers (AWS, Azure, GCP). It covers various connection options, including Site-to-Site VPN, AWS Direct Connect, Azure ExpressRoute, and GCP Cloud Interconnect. Use this skill to design and implement complex hybrid network patterns (e.g., Hub-and-Spoke, Multi-Cloud), ensuring high availability, proper routing (BGP), and adherence to security best practices.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

This skill provides comprehensive methods for collecting and synthesizing Open-Source Intelligence (OSINT) regarding threat actors, malicious infrastructure, and attack campaigns. It utilizes public data sources, passive reconnaissance tools (like WHOIS, Certificate Transparency), and specialized platforms (Maltego, Shodan, SpiderFoot) to map adversary context and perform pre-engagement intelligence gathering for authorized red team assessments. Emphasis is placed on passive collection techniques to ensure legality and operational security.

This guide details how to conduct comprehensive external reconnaissance using Open Source Intelligence (OSINT) techniques. It teaches testers to passively map an organization's entire digital footprint, including enumerating subdomains, discovering internet-facing infrastructure (via Shodan/Censys), identifying personnel data, and analyzing leaked credentials from public sources. Ideal for the initial phases of penetration testing or red team engagements.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

This skill provides comprehensive procedures for identifying and remediating Amazon S3 bucket misconfigurations. It covers enabling Block Public Access settings, auditing policies and ACLs, enforcing default encryption (KMS/AES), and utilizing AWS Config/Lambda for automated remediation. It is essential for maintaining data compliance and responding to security incidents.

An expert playbook detailing DNS rebinding techniques to bypass the Same-Origin Policy (SOP). This method is used in penetration testing to exploit client-side applications that rely on DNS resolution for origin checks, allowing attackers to trick the browser into sending requests to internal, non-publicly accessible services (like cloud metadata endpoints) while maintaining a seemingly trusted origin.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.