Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

Master the complete penetration testing lifecycle, covering all five stages from reconnaissance and scanning to vulnerability analysis using OWASP standards, and advanced exploitation techniques with tools like Metasploit. This skill provides a structured framework for conducting authorized, professional security assessments.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

A comprehensive framework for assessing network security posture. This skill guides the tester through the entire penetration testing lifecycle, from reconnaissance and host discovery (using tools like Nmap) to service enumeration, vulnerability identification (CVEs), and controlled exploitation (Metasploit). It is essential for validating firewall rules, ensuring compliance (e.g., PCI-DSS), and stress-testing critical infrastructure security.

This skill provides comprehensive detection methods for credential dumping techniques, a critical post-exploitation phase in cyber attacks. It targets the extraction of sensitive credentials from LSASS memory, SAM registry hives, and NTDS.dit using advanced security visibility. Detection relies on analyzing Sysmon Event ID 10 (ProcessAccess), Windows Security logs, and complex SIEM correlation rules, making it essential for SOC analysts and threat hunters investigating advanced persistent threats (APTs).

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

This script automates the detection and exploitation of Broken Function Level Authorization (BFLA) in APIs, following OWASP API Top 10 guidelines. It simulates low-privilege users attempting to access or modify restricted administrative endpoints (e.g., user management, system settings) using techniques like role switching, path manipulation, and parameter tampering. Essential for assessing vertical privilege escalation risks and verifying robust Role-Based Access Control (RBAC).

This comprehensive guide outlines methods to identify and exploit specific IPv6 vulnerabilities, including SLAAC spoofing, Router Advertisement (RA) manipulation, and Neighbor Discovery Protocol (NDP) attacks. It is designed strictly for authorized penetration testing to assess dual-stack security controls, detect unauthorized tunnels (like Teredo or 6to4), and validate network defenses against IPv6-specific threats. Always obtain explicit written authorization before use.

This skill demonstrates how to exploit vulnerabilities in JWT implementations, specifically algorithm confusion. It targets APIs that fail to strictly enforce the signing algorithm, allowing attackers to downgrade signatures (e.g., RS256 to HS256) or bypass signature verification entirely (alg:none). Use this for authorized penetration testing of API security and cryptographic integrity.

This guide details the detection and exploitation of the critical MS17-010 (EternalBlue) vulnerability in SMBv1. It covers the full red-teaming lifecycle, including vulnerability scanning using Nmap and executing payloads via Metasploit. It is designed for authorized penetration testing and simulated adversary engagements against legacy Windows environments.