Skill UI

A comprehensive guide covering the end-to-end configuration of SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill details configuring authentication flows (SP/IdP initiated), attribute mapping, secure certificate management, and implementing advanced security hardening like SHA-256 signatures and AES-256 encryption for robust, enterprise-grade access control.

This skill deploys Remote Browser Isolation (RBI) as a core component of a Zero Trust security architecture. It implements sophisticated isolation policies utilizing URL categorization, risk-based routing, and Content Disarming and Reconstruction (CDR) for file sanitization. It provides robust data loss prevention controls, effectively mitigating zero-day exploits, phishing, and data exfiltration across isolated web sessions, and integrating with SWG and ZTNA platforms.

This guide details the architecture and implementation of a ransomware-resilient backup strategy, adhering to the extended 3-2-1-1-0 methodology. It covers critical steps including defining RPO/RTO, establishing immutable/air-gapped copies, isolating backup credentials from the production domain, and automating periodic restore testing. Use this framework to ensure business continuity against sophisticated cyberattacks.

A comprehensive guide to deploying cloud-native deception across AWS, Azure, and GCP. This skill utilizes decoy resources—such as canary IAM keys, honey object storage buckets, and decoy secrets—whose sole purpose is to generate high-fidelity alerts the instant they are interacted with by an attacker. It detects cloud reconnaissance, credential theft, and lateral movement by wiring detection through native logging services (CloudTrail, Sentinel, Cloud Audit Logs), ensuring near-zero false positives for the SOC.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

Implements HashiCorp Vault's dynamic secrets engine to automatically generate, lease, and rotate short-lived credentials for databases (e.g., Postgres, MySQL), AWS IAM keys, and PKI certificates. This eliminates the risk associated with storing static secrets, ensuring compliance with zero-trust principles and automating the entire secret lifecycle.

This skill details the implementation of continuous identity verification for Zero Trust architectures. It covers deploying phishing-resistant Multi-Factor Authentication (FIDO2/WebAuthn), establishing risk-based conditional access policies, and integrating identity governance controls aligned with NIST and CISA frameworks. Learn how to move beyond traditional passwords to dynamic, adaptive security models.

This skill provides comprehensive functionality for monitoring and mapping adversary-controlled assets, such as C2 servers, phishing domains, and exploit kit hosts. By leveraging tools like Passive DNS, Certificate Transparency logs, and specialized scanners (Shodan/Censys), analysts can discover, track, and pivot through complex threat actor infrastructure over time, significantly enhancing security operations and threat intelligence maturity.

Provides a comprehensive guide to implementing Zero Trust Network Architecture on Google Cloud Platform (GCP) using Identity-Aware Proxy (IAP). It enforces rigorous, per-request identity verification and context-aware authorization for services like Compute Engine, App Engine, and Cloud Run. This ensures that only authenticated users who meet specific criteria (e.g., device posture, corporate location, time window) can access protected resources, eliminating reliance on public IPs or VPNs.

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.

CHIPSEC is an open-source framework designed to assess the low-level security configuration of x86 platform firmware and hardware. It verifies critical security controls such as SPI flash write protection, BIOS locks, SMM/SMRR configuration, and Secure Boot variable integrity. Users can run automated tests, dump SPI flash memories for forensics, and detect potential firmware implants that persist below the operating system layer.

This guide details the architecture and deployment of resilient Command and Control (C2) redirectors. By using tools like Nginx and Apache, operators establish an intermediary layer that filters beacon traffic based on malleable C2 profiles. This setup protects the true team server from detection, takedown, and analysis (OPSEC), enabling advanced techniques like domain fronting and traffic shaping for low attribution.