Skill UI

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A comprehensive guide covering advanced offensive methodologies for data exfiltration. Techniques include abusing DNS (dnscat2, iodine), tunneling over HTTPS/CDN, utilizing ICMP, and exploiting cloud storage services. This knowledge is critical for authorized red team engagements and post-exploitation simulations, mapping directly to MITRE ATT&CK tactics like T1048 and T1041.

A deep-dive methodology for authorized penetration testing targeting dependency confusion and namespace resolution vulnerabilities across major package ecosystems (npm, PyPI, NuGet, Maven, etc.). This skill details advanced reconnaissance techniques, from analyzing lock files and source maps to exploiting error messages, alongside safe Proof-of-Concept (PoC) creation using DNS canaries for discovery during penetration engagements.

A comprehensive guide covering advanced Linux privilege escalation techniques. It details a systematic methodology to move from a low-privilege shell to root, exploiting misconfigurations in SUID/SGID binaries, abusing Linux capabilities, targeting sudo flaws (NOPASSWD), and leveraging kernel or system service vulnerabilities. Essential for red team and penetration testing engagements.

A comprehensive guide detailing offensive methodologies for exploiting Layer 2 (ARP spoofing, VLAN hopping) and Layer 3 (DNS poisoning, DHCP attacks) network infrastructure. Covers credential capture, traffic interception, and privilege escalation using tools like Bettercap, Responder, and ntlmrelayx. Essential for authorized internal penetration testing and red teaming.

Details comprehensive methods to maintain unauthorized access (persistence) on both Windows and Linux operating systems. Covers registry manipulation, scheduled tasks (schtasks), WMI event subscriptions, cron jobs, systemd timers, and advanced Active Directory abuses. Essential for authorized red team engagements and simulating advanced threat activity.

A comprehensive guide for authorized red team engagements, covering the end-to-end lifecycle of advanced phishing campaigns. Learn techniques for infrastructure setup (domain aging, SPF/DKIM/DMARC), payload delivery (macro weapons, HTML smuggling), and bypassing email security gateways (MFA bypass, domain spoofing). Essential knowledge for penetration testers and security professionals.

A comprehensive methodology covering advanced offensive techniques targeting the software supply chain. This includes exploiting dependency confusion across npm, PyPI, and NuGet, executing build system hooks, tampering with CI/CD pipelines, and compromising container images. It provides detailed PoC patterns and detection guidance for red team operations.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This advanced tool maps an organization's complete internet footprint by tracing ownership directly from a legal entity (LEI), not just a single seed domain. It discovers owned domains, netblocks, ASNs, and subsidiaries, including 'dark' or unlinked IP space and M&A acquired assets. It provides auditable attribution scoring for robust intelligence gathering.

An advanced, automated pipeline designed for comprehensive, deep-dive Open Source Intelligence (OSINT) gathering and reconnaissance against authorized domains. It executes the full methodology—from passive data harvesting and subdomain discovery to multi-agent content fan-out, vulnerability identification (BOLA/IDOR), and automated findings generation. The output is a single, consolidated, multi-tab deliverable (XLSX), eliminating the need for manual follow-up or superficial reporting.