Skill UI

Utilizes Google Distroless images and multi-stage Docker builds to drastically reduce container attack surface. By eliminating unnecessary OS components like shells, package managers, and core utilities, this technique is essential for hardening container security, meeting compliance requirements, or mitigating risks associated with bloated base images.

This skill guides the implementation of Just-In-Time (JIT) access provisioning, eliminating standing privileges by granting temporary, time-bound access. It covers designing robust approval workflows, integrating with PAM/IGA systems, automating revocation, and adhering to Zero Trust principles, significantly reducing the attack surface.

This guide details the systematic workflow for patch management, covering the entire lifecycle from vulnerability discovery and risk assessment to controlled testing, multi-phased deployment, and final verification. Learn how to integrate tools like WSUS, SCCM, and Ansible into a robust, automated process to significantly reduce the attack surface and ensure compliance across enterprise IT infrastructure.

A comprehensive guide to hardening Kubernetes Role-Based Access Control (RBAC) by enforcing the principle of least privilege. This skill covers auditing excessive cluster-admin roles, implementing namespace-scoped roles, separating service accounts, and integrating external identity providers (OIDC) to significantly reduce the attack surface against privilege escalation and lateral movement.

This guide focuses on developing multi-event correlation rules using Splunk SPL and Sigma format. It teaches how to detect Advanced Persistent Threats (APT) and lateral movement by chaining multiple Windows authentication, process execution, and network connection events across hosts within specified time windows. Use this to surface complex, multi-stage attack sequences that single-event detection rules typically miss.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

This comprehensive guide provides best practices for hardening container images, dramatically minimizing the attack surface in production environments. It covers advanced techniques such as implementing multi-stage builds, using distroless images, running containers as non-root users, and configuring read-only filesystems. Adherence to CIS Docker Benchmark and secure DevSecOps practices are key focuses.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

This skill automates GraphQL introspection attacks to extract the complete API schema, including all types, queries, mutations, and subscriptions. It maps the attack surface, tests for query depth limits, and exploits GraphQL-specific weaknesses like batching attacks or nested query DoS. Used for comprehensive GraphQL security auditing and penetration testing.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

Automate Open Source Intelligence (OSINT) collection and target profiling using the SpiderFoot REST API and CLI. This tool leverages over 200 modules to map an organization's attack surface, collecting structured data including domains, IPs, email addresses, leaked credentials, and DNS records. Ideal for conducting comprehensive security assessments, threat intelligence gathering, and incident response procedures.