Skill UI

This skill provides a comprehensive automation solution for conducting red team phishing simulations using the Python gophish library. It streamlines the entire campaign lifecycle, including creating sophisticated email templates with tracking pixels, configuring SMTP profiles, importing user groups from CSV, launching targeted attacks, and generating detailed reports on open rates, click-through rates, and credential submission statistics for robust security awareness assessments.

A comprehensive guide detailing how to detect and exploit second-order SQL injection vulnerabilities. This technique targets scenarios where malicious input is stored in a database (e.g., user profiles, comments) and subsequently executed in an unsafe SQL query during a completely different application operation, bypassing initial sanitation checks.

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.

This guide details how to perform pre-execution static analysis of Windows PE malware samples using tools like PEStudio, Python's pefile, and FLOSS. It focuses on examining file headers, section entropy, import address tables (IAT), and embedded strings to identify malicious functionalities, packing techniques, and indicators of compromise (IOCs) without running the binary. Ideal for initial triage of suspicious executables.

A comprehensive toolset for digital forensics, designed to detect, extract, and analyze covert data hidden within images, audio, and video files. It utilizes advanced steganalysis techniques (LSB, DCT, frequency domain analysis) and specialized tools (StegDetect, zsteg, binwalk) to uncover hidden communications channels, making it crucial for investigations involving data exfiltration or insider threats.

A comprehensive guide and workflow demonstrating how to use YARA rules for proactive threat hunting. This method helps detect unknown malware, suspicious patterns, and Indicators of Compromise (IOCs) across filesystems, memory dumps, and network artifacts, making it essential for incident response and security analysis.

This tool builds comprehensive forensic super-timelines by using Plaso to correlate events across diverse sources. It aggregates data from file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. This capability is essential for complex digital forensic investigations requiring cross-source event correlation or detailed activity sequence reporting.

Nikto is a powerful, open-source web server and web application scanner designed for comprehensive vulnerability assessment. It tests over 7,000 potentially dangerous files and checks for critical issues like XSS, SQL injection, outdated versions, and misconfigurations across modern web applications. Ideal for security audit, penetration testing, and validating web server security controls.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

Develops comprehensive profiles for Advanced Persistent Threat (APT) groups, criminal organizations, and hacktivist collectivities. This tool aggregates TTP documentation, campaign data, and attribution indicators from major intelligence sources (MITRE ATT&CK, Mandiant, CrowdStrike) to help organizations update threat models, prioritize defensive controls, and prepare executive briefings on sector-specific risks.

A comprehensive guide and workflow for recovering deleted files (documents, images, videos, etc.) from damaged storage media, forensic disk images, or corrupted file systems. It utilizes PhotoRec's file signature-based carving engine, allowing data recovery regardless of file system damage. The process includes advanced steps for file validation, hashing, and organizing evidence for forensic analysis.

Grype is an open-source vulnerability scanner by Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated Software Bill of Materials (SBOMs) to match packages against multiple databases including NVD, GitHub Advisories, and OS-specific feeds. It is ideal for security assessments, CI/CD integration, and implementing severity-based build gates.