Skill UI

Use RESTler to automate stateful security testing of REST APIs. It processes OpenAPI specifications to generate fuzzing grammars, allowing users to discover complex bugs, such as injection vulnerabilities, resource leaks, and unhandled exceptions (500 errors), by executing diverse sequences of API calls. Essential for robust CI/CD regression testing and proactive API security assessments.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

This skill demonstrates how to use Trivy, an open-source security scanner, to perform comprehensive container security assessments. It scans container images, Kubernetes manifests, and Infrastructure as Code (IaC) files for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues. Key features include generating Software Bill of Materials (SBOM) for supply chain transparency and integrating scanning gates into CI/CD pipelines, supporting robust DevSecOps practices.

A comprehensive security auditing tool designed to assess a Kubernetes cluster's compliance posture against established CIS benchmarks. It performs deep checks on control plane components (API Server, etcd, Controller Manager), worker nodes, and Role-Based Access Control (RBAC). Use it for proactive security assessments, compliance validation, and hardening throughout the CI/CD lifecycle.

A comprehensive guide for systematically evaluating Kubernetes cluster security. It simulates advanced attacker techniques against critical components like the API server, etcd, kubelet, RBAC, and network policies, identifying misconfigurations and vulnerabilities. Essential for security auditors, penetration testers, and DevOps teams performing deep cluster security assessments.

This skill details implementing Software Composition Analysis (SCA) using Snyk. It helps security teams detect known vulnerabilities, check license compliance, and automate dependency remediation within CI/CD pipelines. Learn to integrate scanning into GitHub, GitLab, and Jenkins workflows, generate automated fix PRs, and continuously monitor deployed applications to safeguard the software supply chain.

This skill provides a comprehensive guide to executing web cache deception attacks. It details methods for exploiting path normalization discrepancies, delimiter abuse, and cache key manipulation across CDNs and reverse proxies (e.g., Cloudflare, Akamai). Use this during authorized penetration testing to assess if authenticated sensitive content can be cached and retrieved by unauthenticated attackers.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

Trivy is a comprehensive open-source vulnerability scanner used for detecting vulnerabilities, misconfigurations, secrets, and license violations across OS packages, language dependencies, and container images. It integrates seamlessly into CI/CD pipelines for robust security testing and compliance.

Kubesec is a powerful open-source tool designed to perform comprehensive security risk analysis on Kubernetes resource manifests (YAML/JSON). It automatically detects critical misconfigurations, potential privilege escalation vectors, and deviations from industry security best practices. It provides actionable scoring and hardening recommendations, making it essential for CI/CD pipelines, security auditing, and automated compliance checks.