Skill UI

Master the complete penetration testing lifecycle, covering all five stages from reconnaissance and scanning to vulnerability analysis using OWASP standards, and advanced exploitation techniques with tools like Metasploit. This skill provides a structured framework for conducting authorized, professional security assessments.

The Metasploit Framework is the industry standard platform for penetration testing and vulnerability validation. It provides numerous modules (exploits, payloads, auxiliaries) used to confirm if identified security weaknesses are genuinely exploitable. This guide details using Metasploit in a structured, risk-based workflow for authorized testing, including vulnerability checking, post-exploitation assessment, and patch verification.

This guide details passive OT network traffic analysis using Nozomi Networks Guardian sensors. It provides methods to achieve comprehensive asset visibility, real-time threat detection, and vulnerability assessment across sensitive Industrial Control Systems (ICS) without disrupting operations. It is crucial for building robust OT Security Operations Centers (SOCs) and ensuring compliance with industry standards like IEC 62443.

This skill guides the deployment and comprehensive configuration of Rapid7 InsightVM. It covers setting up the Security Console and distributed Scan Engines for both authenticated and unauthenticated vulnerability scanning. Learn how to manage diverse scan templates (e.g., PCI, HIPAA), utilize various credential types (SSH, WMI), and integrate endpoint assessment for robust cybersecurity posture management.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

This guide details how to use OpenVAS/Greenbone Vulnerability Management (GVM) to perform authenticated vulnerability scans. By utilizing valid credentials (SSH for Linux, SMB for Windows), scans can log into target systems, detecting deep local vulnerabilities, missing patches, and misconfigurations far beyond what unauthenticated scans can find. This is essential for comprehensive security assessments and compliance auditing.

This guide details authenticated (credentialed) vulnerability scanning, which uses valid system credentials (SSH keys, domain passwords, etc.) to log into target hosts. Unlike external scanning, credentialed methods allow deep inspection of installed patches, local configurations, registry keys, and system files across diverse platforms (Linux, Windows, Network Devices). This significantly increases vulnerability detection rates and reduces false positives for comprehensive security assessments.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).

This skill simulates and detects critical software supply chain attacks, including typosquatting via Levenshtein distance, dependency confusion detection against private registries, and package integrity verification using SHA-256 hashing. It also performs comprehensive vulnerability scanning against known CVEs using pip-audit. It is essential for security assessments, compliance audits, and incident response when validating software component trustworthiness.

This comprehensive guide details the process of performing authenticated and unauthenticated vulnerability assessments using Tenable Nessus. It covers everything from advanced scan configuration (port discovery, credentialing, plugin setup) to detailed result analysis, including cross-referencing CVEs and prioritizing remediation based on CVSS scores and exploit availability. Ideal for compliance auditing, penetration testing, and maintaining system patch compliance.

This comprehensive guide details advanced network reconnaissance using Nmap's full capabilities. It covers sophisticated host discovery across multiple protocols, deep port scanning with timing and performance tuning, accurate service version enumeration, and OS fingerprinting. Furthermore, it teaches advanced techniques like firewall evasion (fragmentation, spoofing) and running NSE scripts for systematic vulnerability detection, crucial for authorized security assessment reports.

A comprehensive guide detailing various 802.11 management frame attacks, including deauthentication and disassociation. It covers targeted single-client deauth for handshake capture, broadcast DoS attacks, and advanced action-frame exploitation to bypass PMF (802.11w). Essential for professional penetration testing and wireless vulnerability assessment.