Skill UI

This guide details the process of file carving using the Foremost tool in digital forensics. It demonstrates how to recover deleted or fragmented evidence (such as documents, images, and archives) from raw disk images or unallocated space by analyzing file headers and footers, independent of the file system's index. It also covers advanced techniques using custom signatures and high-performance alternatives like Scalpel.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

This comprehensive guide details techniques for performing forensic investigations on Linux systems. It covers analyzing critical logs—including auth.log, syslog, systemd journal, and auditd—to reconstruct user sessions, trace unauthorized access, detect privilege escalation, and establish detailed event timelines following a suspected security compromise.

This skill provides a comprehensive workflow for analyzing malicious software to extract actionable Indicators of Compromise (IOCs). It covers static analysis (PE parsing, hashing, string extraction) and dynamic analysis techniques. Users learn how to identify file hashes, network indicators (C2 IPs, domains), registry modifications, and behavioral artifacts, ultimately formatting the findings into standard STIX 2.1 formats for sharing and incident response.

A comprehensive guide to analyzing volatile memory (RAM) dumps using the Volatility 3 framework. This skill enables the extraction of crucial digital evidence, including running processes, network connections, loaded modules, credentials, and encryption keys. It is essential for incident response, detecting rootkits, process hollowing, or identifying malware when traditional disk-based forensics are insufficient.

A comprehensive guide detailing the process of acquiring and analyzing data from smartphones and tablets. It covers best practices for device isolation, physical/logical acquisition using tools like Cellebrite UFED and open-source alternatives (ALEAPP, iLEAPP), and subsequent deep analysis of communications, call logs, and application artifacts for legal or corporate investigations.

A comprehensive guide and framework for performing digital forensics analysis on PCAP/PCAPNG files. This skill covers using industry-standard tools like Wireshark, tshark, tcpdump, and Python/Scapy to reconstruct network communications, extract evidence of data exfiltration, identify command-and-control (C2) activity, and trace lateral movement during incident response.

This guide details how to use GoPhish, an open-source framework, to conduct authorized phishing simulations. You will learn the complete lifecycle, from deploying the tool and configuring SMTP profiles, to creating realistic email templates and cloning secure landing pages. The skill culminates in analyzing campaign results to assess organizational security posture and improve employee resilience against social engineering attacks.

A comprehensive tool designed for assessing the security posture of Programmable Logic Controller (PLC) firmware. It specializes in detecting critical vulnerabilities such as hardcoded credentials, undocumented debug interfaces, backdoor functions, and memory corruption flaws. The tool supports analyzing major industrial platforms (Siemens, Allen-Bradley) by performing static and dynamic analysis, and verifying firmware integrity against known-good baselines, adhering to standards like IEC 62443. Use only in authorized lab environments.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

A comprehensive guide for Security Operations Center (SOC) teams to perform proactive threat hunting using Elastic SIEM. This skill teaches advanced techniques like KQL and EQL queries, analyzing event sequences, and investigating anomalies to uncover threats that bypass automated detection rules. Ideal for validating detection coverage gaps and responding to new TTPs based on the MITRE ATT&CK framework.

A comprehensive guide detailing how to conduct passive wireless security assessments using Kismet. This skill covers identifying rogue access points, detecting weak encryption (WEP, TKIP), mapping hidden SSIDs, and analyzing raw 802.11 frame types. It is essential for professional network auditing, incident response, and penetration testing in complex wireless environments.