Skill UI

This playbook details the methodology for detecting and exploiting subdomain takeover vulnerabilities. It focuses on identifying CNAME/NS/MX records pointing to deprovisioned or unclaimed cloud resources (e.g., AWS S3 buckets, Heroku apps). Understanding these weaknesses allows attackers to serve malicious content under the victim's trusted domain, leading to phishing, credential theft, and security bypasses.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

A comprehensive playbook detailing expert techniques for lateral movement across Windows networks. It covers various protocols and methods for pivoting between compromised hosts, including PsExec, WMI, WinRM, DCOM, SMB, RDP, and advanced credential techniques like Pass-the-Hash (PTH) and Pass-the-Ticket (PTT).

This utility manages all types of DNS records (A, CNAME, MX, TXT, etc.) for domains registered with Namecheap via their dedicated API. It guides users through the full setup process, including public IP detection and credential configuration. Users can list domains, view, add, update, or remove records, and manage nameservers and email forwarding rules.

This skill guides the architecture and implementation of SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD). It covers establishing seamless Single Sign-On (SSO) capabilities, eliminating the need for separate credentials and ensuring secure, cross-domain authentication for cloud applications.

This framework provides comprehensive detection capabilities for compromised cloud credentials across major platforms including AWS, Azure, and GCP. It analyzes critical threat indicators such as anomalous API activity, impossible travel patterns (impossible login locations), and unauthorized resource provisioning. Designed for incident response, security monitoring, and building robust detection rules to mitigate account takeover and credential abuse.

This skill uses Python and boto3 to analyze AWS CloudTrail logs. It establishes statistical baselines of normal API activity and detects various anomalies, such as unusual event sources, first-time API usage, geographic IP deviations, and high-frequency calls. This is critical for identifying credential compromise, privilege escalation, and unauthorized resource access in a security incident.

This guide provides a comprehensive approach to securing AWS Identity and Access Management (IAM) configurations. It walks practitioners through inventorying existing permissions, using Access Analyzer to identify overly permissive policies, implementing specific resource scoping, and attaching permission boundaries. Key strategies include enforcing least privilege access, managing credential rotation, and meeting stringent compliance requirements like SOC 2 and PCI-DSS.

This guide details the forensic process of extracting sensitive credentials, including password hashes, Kerberos tickets, and authentication tokens, from memory dumps. Utilizing industry-standard tools like Volatility and Mimikatz, this technique is crucial for incident response, determining the scope of a breach, and identifying compromised accounts during digital forensics investigations.

A comprehensive guide detailing the structured process for responding to phishing incidents. It covers email header analysis, malicious content sandboxing (URLs/attachments), scoping the impact across the organization, and performing thorough remediation, including mailbox purging and credential reset.

This skill guides the comprehensive hardening of LDAP directory services. It addresses common vulnerabilities such as LDAP injection, anonymous binding, and credential harvesting. Users can enforce strong security controls, including LDAPS, channel binding, and granular access control lists (ACLs). It is essential when establishing robust identity access management (IAM) architecture or meeting stringent compliance requirements like NIST standards.

A comprehensive skill for monitoring dark web forums, marketplaces, and leak sites to detect mentions of organizational assets, leaked credentials, and ongoing threat actor activities. Used for proactive threat intelligence gathering, incident response enrichment, and establishing continuous dark web OSINT coverage.