Skill UI

This skill assesses SSL/TLS server configurations using the sslyze Python library. It evaluates critical security parameters including supported protocol versions (TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, and known vulnerabilities like Heartbleed and ROBOT. Essential for security audits and compliance testing.

This guide details how to perform pre-execution static analysis of Windows PE malware samples using tools like PEStudio, Python's pefile, and FLOSS. It focuses on examining file headers, section entropy, import address tables (IAT), and embedded strings to identify malicious functionalities, packing techniques, and indicators of compromise (IOCs) without running the binary. Ideal for initial triage of suspicious executables.

A comprehensive toolset for digital forensics, designed to detect, extract, and analyze covert data hidden within images, audio, and video files. It utilizes advanced steganalysis techniques (LSB, DCT, frequency domain analysis) and specialized tools (StegDetect, zsteg, binwalk) to uncover hidden communications channels, making it crucial for investigations involving data exfiltration or insider threats.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.

This skill utilizes PyMISP, the official library, to programmatically manage the lifecycle of threat intelligence within a MISP instance. Users can create structured events containing Indicators of Compromise (IOCs) such as IPs, domains, and hashes, enrich these events with MITRE ATT&CK tags, manage sharing groups, and export the collected data in standardized STIX 2.1 format. Ideal for security assessments, incident response, and integrating external IOC feeds.

Conducts comprehensive, sector-specific threat landscape assessments by profiling key threat actors, mapping attack vectors, and detailing associated MITRE ATT&CK TTPs (covering financial, healthcare, energy, etc.). Utilizing sophisticated data analysis via Python stacks and integrating real-time threat intelligence feeds (ISAC, CVEs), this tool generates highly actionable intelligence for risk management, security investment prioritization, and high-level board-level reporting on industry exposure.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This comprehensive guide details the process of performing authenticated and unauthenticated vulnerability assessments using Tenable Nessus. It covers everything from advanced scan configuration (port discovery, credentialing, plugin setup) to detailed result analysis, including cross-referencing CVEs and prioritizing remediation based on CVSS scores and exploit availability. Ideal for compliance auditing, penetration testing, and maintaining system patch compliance.

This guide details advanced techniques for bypassing Web Application Firewalls (WAFs). It covers methods such as payload obfuscation, advanced URL encoding, HTTP method manipulation (PUT, PATCH, etc.), parameter pollution, and utilizing specialized tools like SQLMap tamper scripts to smuggle exploit payloads (e.g., SQLi, XSS) past perimeter security controls. Essential for penetration testing and red team engagements.

This skill guides users through performing sophisticated web cache deception attacks. It exploits path normalization discrepancies and cache key misconfigurations between Content Delivery Networks (CDNs) and origin servers. Use this methodology to test for sensitive data exposure, cache poisoning, and authentication bypass vulnerabilities in applications protected by aggressive caching layers like Cloudflare or Akamai.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.