Skill UI

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive guide covering the full attack lifecycle in Kubernetes. Techniques include service account token theft, RBAC misconfiguration exploitation, kubelet API abuse, pod escape, and cloud metadata compromise across major cloud platforms (AWS, GCP, Azure). Essential for security assessment and penetration testing of cloud-native environments.

This skill guides developers through configuring Microsoft Entra ID (Azure AD) as a federated identity provider for Webiny projects. It enables Single Sign-On (SSO) by allowing users to authenticate using their corporate Microsoft 365 accounts. The setup involves registering an application in the Entra ID portal and integrating the credentials into the Cognito Federation structure, allowing Cognito to remain the core user pool while utilizing Microsoft identities for login.