Skill UI

This guide provides comprehensive, battle-tested techniques for expanding access across a compromised network. It covers credential-based movement (Pass-the-Hash, Pass-the-Ticket), NTLM relay attacks, and remote execution protocols (WMI, WinRM). Used exclusively in authorized red team engagements and penetration testing, it details command sequences and OPSEC considerations required to reach high-value targets while minimizing detection.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

Configure AWS MCP servers for documentation search and AWS API access with AI agents. Covers checking existing config, choosing between the full server with credentials or the no-auth docs-only server, and verifying tools.

This skill covers using the Azure Identity SDK for Java to authenticate applications with Azure services via Microsoft Entra ID. It details various credential types including DefaultAzureCredential, Managed Identity, Service Principals, and environment variables for secure access management in development and production environments.

This Python library provides authentication capabilities for Azure SDK clients using Microsoft Entra ID. It supports various credential types including DefaultAzureCredential, ManagedIdentityCredential, and ClientSecretCredential. Ideal for secure access to Azure resources like storage and databases in both development and production environments.

This skill enables users to identify and exploit authentication and session management vulnerabilities in web applications. It covers testing methodologies for password policies, session handling, multi-factor authentication, and credential management. Commonly associated with OWASP Top 10 risks, it helps assess security posture against account takeover and unauthorized access.

This skill enables running the Pi agent non-interactively for repository analysis and implementation tasks. It involves setting the Bash working directory, checking Pi availability, and executing sessionless tasks using JSON mode. Users should delegate analysis or implementation to Pi by passing prompts as quoted arguments. Security measures include limiting tool access and avoiding credential handling.

Extract backend API routes from SPA JavaScript bundles to identify missing authentication or broken access control vulnerabilities. Test endpoints without credentials to find unauthenticated data exposure and security gaps in web applications.

Validate and fix n8n expression syntax in workflows. Covers {{}} syntax, $json/$node variables, webhook data access, and common pitfalls like Code nodes and credential fields. Includes practical examples for webhook-to-Slack and HTTP-to-Email integrations.