Skill UI

A comprehensive guide and workflow for digital forensic investigators to analyze ransomware artifacts. This process involves preserving volatile evidence (memory dumps), identifying the ransomware variant from file extensions and ransom notes, establishing the attack timeline using Prefetch and Event Logs, and extracting critical Indicators of Compromise (IoCs) such as Bitcoin addresses and Tor sites. Essential for incident response and recovery planning.

Utilizes ScoutSuite, an open-source multi-cloud auditing tool, to perform comprehensive, agentless security posture assessments across AWS accounts. It queries various AWS APIs to enumerate all resources, identify misconfigurations (such as publicly exposed S3 buckets or weak IAM policies), and generate detailed, actionable HTML reports for compliance and security auditing.

This skill simulates various network attack scenarios, including bandwidth throttling, traffic shaping, and network degradation, using tools like tc, iperf3, and Scapy. It is designed for authorized security assessments to test the resilience of applications, validate Quality-of-Service (QoS) policies, and assess the ability of network monitoring tools to detect sophisticated traffic manipulation attacks (e.g., Slowloris-style attacks).

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

This skill covers advanced techniques used in red teaming and penetration testing to elevate privileges from a low-level user to root access on a compromised Linux system. It details how to enumerate and exploit various vectors, including SUID/SGID binaries, misconfigured sudo rules, kernel vulnerabilities (e.g., Dirty Pipe), Cron job abuse, and abusing system services. Essential for comprehensive security assessments.

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

This skill provides a comprehensive guide for deploying Microsoft Defender for Cloud across Azure, multi-cloud, and hybrid environments. It covers activating specific Defender plans for various workloads (servers, containers, storage), optimizing the Secure Score, establishing environment connectors for AWS/GCP, and implementing advanced controls like Just-In-Time (JIT) access for robust, centralized cloud workload protection.

A comprehensive methodology for penetration testing web applications to identify broken access control vulnerabilities. This guide covers systematic testing for Role-Based Access Control (RBAC), privilege escalation, insecure direct object references (IDOR), and API authorization flaws in multi-tenant environments. It outlines the use of tools like Burp Suite and ffuf to map endpoints and simulate various user roles.

A comprehensive framework for advanced forensic analysis of UEFI firmware and boot process integrity. It details methods to detect firmware implants in SPI flash, audit UEFI variables (PK, KEK, DB), inspect the EFI System Partition (ESP) for unauthorized components, and analyze boot chain anomalies. Ideal for investigating advanced persistent threats (APTs) and verifying system security posture against rootkits and bootkit techniques.

This skill details the deployment of various canary tokens (DNS, HTTP, AWS API Keys) across enterprise network infrastructure. It establishes digital tripwires that detect behavioral anomalies, such as unauthorized access, credential leakage, or lateral movement. Tokens are configured with webhook alerts (Slack, SIEM) for real-time, low-false-positive notification, significantly enhancing traditional IDS/IPS capabilities.