Skill UI

This skill provides a comprehensive methodology for simulating privilege escalation attacks on compromised Linux and Windows environments. It guides the user through identifying vectors—including SUID abuse, misconfigured services, kernel vulnerabilities, cron job exploitation, and credential harvesting—to elevate initial low-privilege access to root or SYSTEM control. It is crucial for deep-dive penetration testing and assessing system security hardening.

This guide details advanced techniques used in red teaming and penetration testing to elevate user privileges from a low-level account to root access on a compromised Linux system. It covers exploiting misconfigurations, vulnerable services (like SUID/SGID binaries), improper sudo rules, kernel vulnerabilities (e.g., Dirty Pipe), and abuse of system services like Cron jobs and Systemd. Essential for authorized security assessments.

A comprehensive guide to securing AWS Lambda execution roles. It details implementing least-privilege IAM policies, utilizing permission boundaries, and restricting resource-based policies. The workflow includes auditing existing permissions using AWS CLI, analyzing actual API usage with CloudTrail and IAM Access Analyzer, and programmatically creating highly scoped policies to minimize the security attack surface.

This guide details the comprehensive process of securing a container registry using Harbor. Learn how to implement advanced security features such as integrated vulnerability scanning (Trivy), image signing (Cosign/Notary), Role-Based Access Control (RBAC), and content trust policies. The workflow covers deployment, policy enforcement, and integrating external authentication like OIDC, ensuring compliant and secure image provenance for Kubernetes environments.

Defines a secure remote access workflow for OT/ICS environments, detailing jump server architecture, MFA, vendor controls, session recording, and compliance with IEC 62443 and NERC CIP-005-7 so operators and engineers can replace insecure VPN tunnels.

Guides building an IEC 62443-conformant conduit architecture to gate remote OT access via jump servers, MFA, approval workflows, session recording, and time-limited vendor/engineer sessions.

Manages production-grade secret infrastructure, covering Vault clusters, cloud secret stores, auth methods, rotation, and audit patterns to harden DevOps pipelines and respond to leaks.

Analyzes UEFI bootkit persistence mechanisms across firmware implants, ESP tampering, and Secure Boot bypass techniques to guide firmware integrity audits, ESP inspection, and malware investigations.

This guide provides comprehensive best practices for creating optimized, secure, and efficient multi-stage Dockerfiles. Learn how to separate build environments (builder stage) from minimal runtime environments, significantly reducing image size and attack surface. Topics covered include layer caching optimization, security hardening (non-root users), and using minimal base images for reproducible builds.

This guide details the operational workflow for namespace-scoped tenants within KubeSphere DevOps. It outlines how users without cluster-admin privileges can securely perform DevOps operations by strictly utilizing KubeSphere's dedicated APIs (`/kapis/`) and authenticating via OAuth tokens, ensuring strict resource isolation and access control within their designated namespace.

This guide details securing the CAST AI integration across multiple layers. It covers best practices for API key management (including rotation and secrets storage), implementing least-privilege RBAC using 'kubectl', deploying the Kvisor security agent for runtime scanning, and setting up Kubernetes Network Policies to restrict egress traffic. Use this when hardening production clusters or performing security audits.

Provides a comprehensive reference architecture for deploying highly scalable, low-latency applications on Fly.io. It details best practices for multi-region web tiers, achieving high availability with Postgres read replicas, implementing Redis caching, managing background workers, and securing connectivity via private internal networking for robust production systems.