Skill UI

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

Proof Of Vulnerability streamlines the creation and submission of evidence that a security flaw can be exploited, ensuring teams can quickly validate issues and coordinate fixes with a reproducible discovery narrative.

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

A comprehensive workflow for performing static and dynamic analysis of malicious PDF documents. It utilizes tools like peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Ideal for triaging phishing attachments, analyzing exploit documents, and building threat signatures in a controlled forensic environment.

This comprehensive toolkit provides deep static analysis capabilities for suspicious PDF documents. Using tools like PDFiD, pdf-parser, and peepdf, it identifies embedded malicious structures—including JavaScript code, shellcode, auto-actions, and exploit kits—without opening or rendering the file. It is essential for security analysts conducting threat triage, forensic investigation, and assessing potential attack vectors from suspicious attachments.

This tool is designed for advanced threat hunting and digital forensics. It analyzes Windows Event Logs (specifically Script Block Logging 4104 and Module Logging 4103) to detect artifacts left by the PowerShell Empire post-exploitation framework. Detection patterns include default launchers, Base64 payloads (WebClient, FromBase64String), known module invocations (e.g., Invoke-Mimikatz), and staging URL patterns, helping confirm C2 activity and lateral movement.

This comprehensive guide details the deployment and hardening of the Havoc C2 framework, a modern post-exploitation Command and Control system. Learn how to establish a production-grade infrastructure, including configuring Teamservers, setting up various listeners (HTTP/HTTPS/SMB), and integrating Nginx redirectors. It provides OPSEC-hardened techniques for authorized red team adversary emulation engagements.

A comprehensive guide covering methodologies for conducting authorized penetration testing across major cloud platforms, including AWS, Azure, and GCP. It details the shared responsibility model, techniques for exploiting IAM misconfigurations, testing for SSRF vulnerabilities to cloud metadata services, and utilizing industry tools like Pacu and ScoutSuite. Findings are mapped to the MITRE ATT&CK Cloud matrix for robust reporting.

This technique abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller (DC). By exploiting replication rights (e.g., DS-Replication-Get-Changes-All), attackers can dump password hashes for critical accounts, such as KRBTGT and Domain Admins. The extracted hashes are used to forge Golden Tickets, achieving long-term, persistent domain access. This is a critical post-exploitation method used during authorized red team engagements.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

A comprehensive framework for assessing network security posture. This skill guides the tester through the entire penetration testing lifecycle, from reconnaissance and host discovery (using tools like Nmap) to service enumeration, vulnerability identification (CVEs), and controlled exploitation (Metasploit). It is essential for validating firewall rules, ensuring compliance (e.g., PCI-DSS), and stress-testing critical infrastructure security.