Skill UI

Cartography syncs multi-cloud assets (AWS, GCP, Azure) into a Neo4j graph database. It maps relationships like IAM chains, network paths, and cross-account trusts, allowing security teams to conduct comprehensive asset inventories, identify complex attack paths, and generate detailed security reports across heterogeneous cloud environments.

This skill guides users through performing sophisticated web cache deception attacks. It exploits path normalization discrepancies and cache key misconfigurations between Content Delivery Networks (CDNs) and origin servers. Use this methodology to test for sensitive data exposure, cache poisoning, and authentication bypass vulnerabilities in applications protected by aggressive caching layers like Cloudflare or Akamai.

A comprehensive guide and set of payloads for identifying and exploiting Open Redirect vulnerabilities. It covers various parameters (next, redirect_uri), advanced bypass techniques (encoding, path traversal, protocol abuse), and chaining findings with OAuth or phishing attacks using tools like Burp Suite and OWASP ZAP.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A comprehensive guide to hardening Windows Active Directory environments using Group Policy Objects (GPO). This skill configures multiple layers of defense, including AppLocker, Controlled Folder Access, and Attack Surface Reduction (ASR) rules, to prevent ransomware execution paths, block unauthorized file modifications, and restrict lateral movement across the domain.

This skill provides a comprehensive, structured methodology and checklist for identifying Remote Code Execution (RCE) vulnerabilities across various web applications. It covers advanced attack vectors such as OS command injection, Server-Side Template Injection (SSTI), insecure deserialization, file upload flaws, and XXE. Use this guide during web application penetration testing or bug bounty hunting to systematically discover arbitrary code execution paths.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

Techniques for attacking WPA/WPA2/WPA3-Enterprise 802.1X networks, including EAP method identification, evil-twin RADIUS credential capture, MSCHAPv2 cracking, and EAP-TLS certificate theft paths in corporate Wi-Fi environments.

A comprehensive playbook for bypassing 401/403 Forbidden errors. Covers advanced techniques like path normalization tricks (encoding, traversal), HTTP method tampering, IP spoofing headers, and protocol downgrade attacks. Essential knowledge for penetration testing and security auditing.

A sophisticated payload bypass technique targeting Java applications. It exploits the silent loss of high 8 bits when 16-bit Java characters are cast or written as 8-bit bytes. This allows attackers to bypass WAF/IDS security measures by making the WAF see harmless Unicode, while the backend service processes the original malicious ASCII byte payload. Ideal for blind SQLi, deserialization RCE, and path traversal. This primitive affects major frameworks like Tomcat, Spring, Jackson, and HttpClient.

This comprehensive playbook details advanced techniques for detecting Prototype Pollution vulnerabilities in JavaScript environments (Node.js and browser). It covers various attack vectors, including using `__proto__` and `constructor.prototype` paths, and provides black-box testing payloads for JSON parsing, query string merging, and deep object assignment. Use this when analyzing applications for potential Remote Code Execution (RCE) or unintended property leakage via object merging sinks.

Entry-level reconnaissance router for new targets and unknown attack surfaces. Helps map scope, discover assets, fingerprint technology, inventory endpoints, and choose the first high-value security testing path.