Skill UI

A comprehensive guide for digital forensics professionals to investigate compromised Docker containers. It covers best practices for preserving container state, analyzing image layers, reviewing runtime logs, and examining host system artifacts to identify evidence of malicious activity, container escapes, or misconfigurations.

A comprehensive, multi-step workflow for analyzing and deobfuscating highly complex and malicious JavaScript code. It guides users through extracting scripts from phishing pages and web skimmers, identifying obfuscation techniques (Base64, Unicode escapes, eval chains), neutralizing anti-analysis features, and progressively decoding string layers to reveal the original malicious payload for thorough threat intelligence and malware analysis.

Detects container escape attempts at runtime by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounts, and anomalous syscalls. Explains which signals matter for Falco, Sysdig, auditd, or EDR collection. Use when investigating suspected Docker/Kubernetes breakouts or comparing runtime sensor coverage.

Authoring and tuning Falco rules to detect container escape techniques, including host filesystem mounts, nsenter usage, privileged containers, kernel module loading, and host manipulation. Covers rule syntax, condition tuning, output fields, priorities, and false positive reduction.

Tetragon utilizes eBPF technology to provide deep, low-overhead security observability and runtime enforcement directly within Kubernetes clusters. It monitors system calls, process execution, file access, and network connections at the kernel level, allowing users to detect or block dangerous activities like container escapes or privilege escalation, ensuring robust cluster security and compliance.

This tool audits Kubernetes pod configurations to detect potential container escape misconfigurations. It checks for dangerous settings like privileged flags, excessive capabilities, host path mounts, shared namespaces, and cgroup abuses. Use it for comprehensive security assessments, compliance checking, or generating pre-enforcement security posture reports.

A comprehensive guide to systematically evaluating Kubernetes cluster security by simulating advanced attacker techniques. It covers attacking the API server, kubelet, etcd, RBAC, and secrets using specialized tools like kube-hunter, Kubescape, and peirates. Essential for authorized security assessments and hands-on validation of cluster defenses.

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

A comprehensive playbook covering advanced V8 and Chromium exploitation techniques. It details complex vulnerabilities such as JIT type confusion, incorrect bounds elimination, and pointer compression bypass. This guide is essential for understanding the mechanisms required to achieve renderer RCE and sandbox escape in modern browsers.

A comprehensive guide covering expert techniques for breaking out of container isolation. This playbook details methods for exploiting privileged modes, abusing cgroups, manipulating namespaces, and leveraging vulnerabilities in Docker or Kubernetes environments. Essential for advanced security research and penetration testing.

A comprehensive playbook detailing advanced techniques for attacking Kubernetes clusters. Covers API server access, RBAC privilege escalation, service account token abuse, etcd secrets extraction, Kubelet exploitation, and various container escapes. This guide is essential for security professionals and red teams performing deep security assessments on cloud-native infrastructure.

A comprehensive playbook detailing expert techniques to escape multiple types of restricted environments, including Python pyjail, Docker containers, seccomp filters, and browser rendering processes. It covers advanced exploitation vectors like namespace escapes, kernel exploits, and built-in function bypasses for achieving code execution.