Skill UI

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.

A comprehensive guide to deploying decoy artifacts, such as fake credentials, URLs, and files, called honeytokens or canarytokens. These tokens have no legitimate operational use; therefore, any interaction with them provides a high-fidelity, low-false-positive signal of an intrusion, data theft, or insider threat. Use this technique to enhance detection in low-telemetry areas like file shares or credential stores.

A comprehensive framework for authorized AWS penetration testing and red-teaming. This skill automates end-to-end cloud exploitation using Pacu, covering session management, deep IAM enumeration, automated privilege escalation scanning, and establishing persistence backdoors. It is designed to assess the full blast radius of compromised cloud credentials.

NetExec is a comprehensive, multi-protocol tool designed for authorized penetration testing and red-teaming. It functions as a 'swiss-army knife' for assessing Windows, Active Directory, and Linux environments. Key capabilities include validating credentials, performing password spraying, enumerating network shares, executing commands across multiple protocols (SMB, WinRM, LDAP, MSSQL, SSH), and dumping critical credentials (SAM, LSA, NTDS). It directly supports techniques for lateral movement and post-exploitation activities.

This technique exploits vulnerable Active Directory Certificate Services (AD CS) HTTP web-enrollment endpoints (ESC8) that lack Extended Protection for Authentication (EPA). By coercing a Domain Controller (DC) to authenticate and relaying the captured NTLM credentials, an attacker can obtain a DC machine certificate. This certificate is then used via PKINIT to request a TGT, recover the DC's NT hash, and ultimately achieve full domain compromise via DCSync. Essential for advanced AD red-teaming simulations.

This skill guides the process of converting complex, repetitive, and often private operational workflows originating in the Hermes environment into safe, reusable, and public skills for the ECC workflow layer. It focuses heavily on data sanitization, requiring users to strip out all sensitive information such as absolute paths, private credentials, personal identifiers, and proprietary data before publication. Use this when an internal 'operator' routine needs to become a standardized, shareable business asset.

A comprehensive guide for bringing RuView CSI sensing nodes (ESP32-S3/C6) online. This skill covers the full lifecycle: building the embedded firmware, flashing the device, provisioning WiFi credentials, and confirming the Continuous Sensing Image (CSI) data stream. Essential for physical hardware deployment and debugging of complex sensing systems.

This utility switches the active operational credential profile to manage different brands within a multi-client agency environment. It performs mandatory, deep validation of API keys, OAuth tokens, and environment variables before switching, ensuring that all subsequent platform operations (e.g., ad spending, reporting) are correctly routed to the target brand's account. It is crucial for preventing cross-client data leakage and maintaining audit integrity.

This skill serves as a comprehensive pre-flight check to ensure a brand profile is complete and all linked credentials/connectors are reachable. It validates required identity fields, voice/audience completeness, and live connector connectivity, without exposing any sensitive credential values. Use it after onboarding, key rotation, or profile edits to guarantee production readiness.

The Azure CLI command group for managing Azure Container Registry (ACR). This tool allows users to perform the entire ACR lifecycle, including creating registries, authenticating credentials, building and pushing container images (using cloud builds), importing images from other sources, and configuring advanced features like geo-replication, private endpoints, and webhooks. Essential for CI/CD pipelines and container deployment workflows in Azure.

This guide provides a comprehensive methodology for the reverse engineering of browser extensions (Chrome/Firefox). It covers analyzing the manifest, tracing background workers, content scripts, and recovering sensitive logic like credentials or network traffic. Essential for security research, malware investigation, and supply chain security auditing.

This specialized skill is designed for advanced security analysis, tracing the complete trust chain from cloud metadata services to accepted privilege. It is used in penetration testing or CTF environments to meticulously prove how metadata-derived credentials (such as instance identities or tokens) are issued and subsequently accepted by a cloud or control plane API, thereby exposing the decisive trust edge.