Skill UI

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.

Guide for performing Android and iOS mobile application penetration testing with OWASP MASTG/MASVS, covering static/dynamic analysis, data storage checks, API abuse, and runtime manipulation using Frida, Objection, and MobSF.

A comprehensive guide and analysis framework for detecting compromised Office 365 or Google Workspace email accounts. It focuses on analyzing unified audit logs and Azure AD sign-in logs to identify indicators of account takeover (ATO) or Business Email Compromise (BEC). Detection methods include monitoring impossible travel events, identifying malicious inbox rules (e.g., external forwarding or deletion rules), and analyzing suspicious Microsoft Graph API access patterns.

A comprehensive skill for detecting advanced malware techniques, including DLL injection, process hollowing, APC injection, and thread hijacking. Utilizes memory forensics (Volatility), API monitoring (Sysmon), and behavioral analysis to identify malicious code artifacts and suspicious process activities in a deep defense context.

This tool discovers and inventories 'shadow APIs'—endpoints that operate outside documented specifications (OpenAPI/Swagger). It utilizes advanced traffic analysis against API gateways (e.g., Kong, AWS API Gateway), cloud configuration scanning, and source code mining. Essential for assessing the complete API attack surface, auditing forgotten services, or establishing robust API governance policies.

This skill implements comprehensive API security testing using the 42Crunch platform. It combines static analysis (API Audit) on OpenAPI definitions, dynamic vulnerability scanning (API Conformance Scan) against running APIs, and runtime threat protection. Ideal for integrating OWASP API Security Top 10 checks into CI/CD pipelines and IDEs, enabling 'shift-left' security practices.

A comprehensive guide on implementing AWS CloudTrail log analysis for robust security monitoring, threat detection, and forensic investigation. Learn how to configure CloudTrail, use Amazon Athena for SQL querying, and leverage CloudWatch Logs Insights and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity across AWS services.

This tool provides comprehensive network traffic analysis capabilities by querying the Arkime API. Users can search sessions, download PCAPs for forensics, detect sophisticated threats like C2 beaconing (via jitter/interval analysis), spot DNS tunneling patterns, and flag connections to known-bad TLS certificate issuers. Ideal for security assessment and incident investigation.

This skill automates the entire phishing incident response lifecycle using the Splunk SOAR REST API. It processes reported emails, extracts indicators of compromise (IOCs) like URLs and IPs, creates incident containers, attaches artifacts, and triggers automated playbooks for deep analysis and reporting. It is essential for security operations teams needing robust, programmatic incident handling and compliance alignment.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.