Skill UI

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

This script automates the detection and exploitation of Broken Function Level Authorization (BFLA) in APIs, following OWASP API Top 10 guidelines. It simulates low-privilege users attempting to access or modify restricted administrative endpoints (e.g., user management, system settings) using techniques like role switching, path manipulation, and parameter tampering. Essential for assessing vertical privilege escalation risks and verifying robust Role-Based Access Control (RBAC).

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

A comprehensive playbook detailing identification and bypass techniques for major binary protections, including ASLR, PIE, NX/DEP, RELRO, and stack canaries. This guide is essential for understanding how to exploit modern, difficult-to-break systems in advanced security research and CTF competitions.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.