Skill UI

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

This guide details how to use OWASP Threat Dragon, an open-source tool, for comprehensive threat modeling. It enables security teams and developers to create data flow diagrams (DFD), identify potential vulnerabilities using standard methodologies like STRIDE and LINDDUN, and generate detailed threat reports. It is crucial for secure design review, risk assessment, and continuous security validation in DevSecOps pipelines.

Guides capturing WPA/WPA2 handshakes with monitor-mode adapters, then using aircrack-ng, hashcat, and curated dictionaries to assess passphrase strength during authorized wireless security assessments and document the findings and cleanup.

Guides security teams through end-to-end wireless network penetration testing—scanning 802.11 bands, capturing WPA handshakes, cracking credentials, deploying rogue APs, and validating segmentation and client isolation with Aircrack-ng, Hashcat, Bettercap and supporting tools.

Use Anchore Grype to scan container images, archives, and SBOMs for known CVEs, enforce severity thresholds, and integrate results into CI/CD pipelines for consistent container security posture.

Integrates Aqua Security’s Trivy scanner into CI/CD workflows to automatically scan Docker images, IaC files, and configs for OS and dependency CVEs, enforce severity-based quality gates, and block vulnerable images before deployment.

A comprehensive guide to securing AWS Lambda execution roles. It details implementing least-privilege IAM policies, utilizing permission boundaries, and restricting resource-based policies. The workflow includes auditing existing permissions using AWS CLI, analyzing actual API usage with CloudTrail and IAM Access Analyzer, and programmatically creating highly scoped policies to minimize the security attack surface.

This guide details the comprehensive process of securing a container registry using Harbor. Learn how to implement advanced security features such as integrated vulnerability scanning (Trivy), image signing (Cosign/Notary), Role-Based Access Control (RBAC), and content trust policies. The workflow covers deployment, policy enforcement, and integrating external authentication like OIDC, ensuring compliant and secure image provenance for Kubernetes environments.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

Performs targeted security assessments of JSON Web Token implementations, probing algorithm confusion, claim tampering, brute-force secrets, and misuse during penetration tests of APIs, SSO, and microservice authentication flows.

Vibers provides a human code review workflow for AI-generated GitHub projects; add the collaborator, GitHub Action, and commit guidance to receive spec- and security-focused feedback plus follow-up PR fixes.