Skill UI

Guides penetration testers through discovering endpoints, validating authentication, checking for CSWSH, and probing message injection flaws in WebSocket implementations using Burp Suite, wscat/websocat, and custom Python scripts during authorized assessments.

Blueprint for implementing cloud security posture management across AWS, Azure, and GCP using native services plus Prowler and ScoutSuite scans, automated daily pipelines, and unified aggregation to surface misconfigurations and compliance drift.

Implements multi-cloud CSPM by wiring AWS Security Hub, Azure Defender for Cloud, and tools like Prowler and ScoutSuite to detect misconfigurations and posture risks.

Intercepts mobile app HTTP/HTTPS traffic through a Burp Suite proxy to analyze insecure APIs, authentication flaws, certificate pinning, data leakage, and server-side responses during mobile penetration tests or API security assessments.

Use ScoutSuite to enumerate AWS accounts, capture resource configurations, surface misconfigurations, and create interactive reports so audit, incident response, or compliance teams can prioritize remediation efforts.

Provides a workflow for authorized penetration testing across AWS, Azure, and GCP to discover IAM, storage, serverless, and compute weaknesses, leveraging Pacu, ScoutSuite, Prowler, and cloud-native tools.

Simulates CSRF attacks during authorized penetration tests to exercise state-changing endpoints, evaluate anti-CSRF tokens, SameSite cookies, and header checks, then craft PoCs via Burp Suite for remediation insight.

Guides security teams through Forseti, SCC, and gcloud workflows to audit IAM policies, firewall rules, bucket permissions, and CIS benchmark compliance across GCP organizations with optional ScoutSuite comparison and BigQuery exports for analysis.

This skill provides a comprehensive method for assessing SSL/TLS server configurations using the powerful Python library, sslyze. It evaluates crucial security aspects including supported protocol versions (e.g., TLS 1.2, 1.3), cipher suite strength, certificate chain validity, HSTS enforcement, and checks for common vulnerabilities like Heartbleed and ROBOT. Ideal for penetration testing, security auditing, and incident response.

This guide details a comprehensive methodology for penetration testing desktop (thick client) applications. It covers static and dynamic analysis, focusing on identifying vulnerabilities such as hardcoded credentials, insecure local storage, DLL hijacking, memory manipulation, and API communication flaws. Tools like dnSpy, Procmon, and Burp Suite are utilized for in-depth security auditing of enterprise and banking software.

Build forensic super-timelines with Plaso's log2timeline/psort suite, ingesting disk images and artifacts, applying parser or filter selections, and exporting to Timeline Explorer or Timesketch to correlate events across investigations.

Guides systematic OWASP WSTG web app penetration tests using Burp Suite plus manual techniques to uncover authentication, authorization, input validation, session, and business logic vulnerabilities for compliance and preproduction assurance.