Skill UI

A comprehensive checklist designed to validate that an Oracle Cloud Infrastructure (OCI) environment meets rigorous production-grade standards. This tool automates checks for critical security controls, including compartment isolation, backup policy enforcement, NSG/security list auditing, API key rotation status, encryption verification, and compliance monitoring via Cloud Guard. Use it when preparing an OCI environment for mission-critical workloads or conducting a formal security audit.

This comprehensive skill guide provides deep insight into Oracle Cloud Infrastructure (OCI) IAM policy syntax and best practices. It covers the privilege verb hierarchy (inspect, read, use, manage), the correct structure for policy statements, and common patterns for granting least-privilege access across various compartments. Use this when developing automation scripts, setting up complex access control policies, or performing security audits in OCI.

This guide details how to deploy SerpApi-powered search functionality into production environments using modern serverless platforms like Vercel and Google Cloud Run. It critically emphasizes the security requirement: all API calls must be proxied through a secure backend endpoint and must never expose the API key to client-side browsers, ensuring robust and secure search integrations.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A comprehensive playbook detailing advanced techniques for attacking Kubernetes clusters. Covers API server access, RBAC privilege escalation, service account token abuse, etcd secrets extraction, Kubelet exploitation, and various container escapes. This guide is essential for security professionals and red teams performing deep security assessments on cloud-native infrastructure.

This comprehensive playbook details expert techniques for exploiting Server-Side Request Forgery (SSRF). It covers bypassing URL filters, accessing cloud metadata endpoints (AWS, GCP, Azure), utilizing advanced protocols like Gopher, and chaining vulnerabilities to achieve Remote Code Execution (RCE) in real-world scenarios. Ideal for penetration testers and security researchers.

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

This workflow automates the AWS Well-Architected Framework (WAF) review. It scans Infrastructure as Code (IaC) files (Terraform, CloudFormation, CDK) and deployed AWS resources against 6 pillars (Security, Reliability, etc.). It identifies risks, generates detailed findings, and automatically creates trackable GitHub issues for remediation, ensuring adherence to industry best practices.

This tool conducts structured reviews of various Infrastructure-as-Code (IaC) tools (e.g., Terraform, Pulumi) across multiple cloud providers. It generates an actionable report that categorizes findings by severity (Critical, High, Medium, Low), providing detailed remediation steps and a reusable best-practice checklist for continuous security, compliance, and operational auditing.

This guide details how to establish SAML 2.0 identity federation between on-premises Active Directory (using AD FS or third-party IdP) and Microsoft Entra ID. It covers hybrid identity architectures, configuring federation models (AD FS, PHS, PTA), and implementing the full SAML authentication flow. Essential for extending on-premises authentication authority to cloud resources and maintaining security compliance.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.