Skill UI

This guide outlines the implementation of Remote Browser Isolation (RBI) as a core component of a Zero Trust architecture. It details policies for URL risk classification, Data Loss Prevention (DLP) controls, and Content Disarm and Reconstruction (CDR). This is essential for hardening web access, protecting against zero-day exploits, phishing, and preventing data exfiltration from untrusted web content.

This skill provides a comprehensive guide and structured SQL templates for performing deep forensic investigations on AWS cloud logs. It utilizes AWS Athena to query massive datasets from CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs. Ideal for detecting unauthorized access, data exfiltration, and privilege escalation during security incident response.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

A powerful technique used when full XSS is blocked by CSP, sanitizers, or WAFs, but HTML injection is possible. It leverages unclosed HTML tags (like <img> or <link>) to capture and exfiltrate sensitive page data (CSRF tokens, session IDs, form values) by forcing the browser to include the subsequent content in a request URL.

A comprehensive expert playbook detailing advanced Large Language Model (LLM) prompt injection techniques. Covers direct methods (instruction override, role play), indirect attacks (RAG poisoning, web data manipulation), and sophisticated tool/function calling abuse for data exfiltration and security bypass. Essential for rigorous AI application security testing.

A comprehensive and advanced playbook for mastering SQL injection techniques. It covers critical areas including WAF bypass, out-of-band data exfiltration, second-order injection, and exploitation strategies across major database systems (MySQL, MSSQL, Oracle, PostgreSQL). Essential for professional penetration testing and security auditing.

A comprehensive, expert-level playbook covering XML External Entity (XXE) vulnerabilities. This guide details advanced attack techniques across multiple contexts, including SOAP, REST, SVG, and Office files. Key topics covered include blind detection, out-of-band (OOB) data exfiltration, local file reading (e.g., /etc/passwd), and chaining XXE to achieve SSRF or RCE.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

This skill deploys Remote Browser Isolation (RBI) as a core component of a Zero Trust security architecture. It implements sophisticated isolation policies utilizing URL categorization, risk-based routing, and Content Disarming and Reconstruction (CDR) for file sanitization. It provides robust data loss prevention controls, effectively mitigating zero-day exploits, phishing, and data exfiltration across isolated web sessions, and integrating with SWG and ZTNA platforms.

This advanced skill specializes in analyzing complex mail-related abuse scenarios, including OAuth consent flows, forwarding rule exploitation, shared mailbox access, and transport rule manipulation. It is used in forensic investigations to trace message artifacts, identify persistence mechanisms, and prove privilege escalation or data exfiltration following a compromise.

A comprehensive guide covering advanced offensive methodologies for data exfiltration. Techniques include abusing DNS (dnscat2, iodine), tunneling over HTTPS/CDN, utilizing ICMP, and exploiting cloud storage services. This knowledge is critical for authorized red team engagements and post-exploitation simulations, mapping directly to MITRE ATT&CK tactics like T1048 and T1041.