Skill UI

A comprehensive guide for digital forensics professionals to investigate compromised Docker containers. It covers best practices for preserving container state, analyzing image layers, reviewing runtime logs, and examining host system artifacts to identify evidence of malicious activity, container escapes, or misconfigurations.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

A comprehensive guide and script collection for auditing Google Cloud Platform IAM permissions. It helps identify overly permissive bindings, unused service accounts, primitive role usage, and cross-project access risks. It utilizes gcloud CLI, Policy Analyzer, and IAM Recommender to ensure compliance and minimize the blast radius of misconfigurations.

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.

Guides security architects through designing and deploying a continuous CSPM program across AWS, Azure, and GCP, covering tool selection, policy baselines, automation, and SOC integration to monitor misconfigurations and prioritize remediation.

A comprehensive guide covering methodologies for conducting authorized penetration testing across major cloud platforms, including AWS, Azure, and GCP. It details the shared responsibility model, techniques for exploiting IAM misconfigurations, testing for SSRF vulnerabilities to cloud metadata services, and utilizing industry tools like Pacu and ScoutSuite. Findings are mapped to the MITRE ATT&CK Cloud matrix for robust reporting.

This skill audits Azure Blob and ADLS storage accounts for critical security misconfigurations. It checks for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, and outdated TLS versions. Using the Python SDK, it generates a detailed, risk-scored report to enhance cloud security posture management and detect potential data exposure risks.

This guide provides a comprehensive framework for auditing Azure Storage accounts to detect critical security misconfigurations. It specifically checks for publicly accessible blob containers, insufficient encryption settings (e.g., missing infrastructure encryption), overly permissive network rules, and exposed SAS tokens. It is essential for compliance verification, responding to security alerts (like anonymous access), and establishing a robust security baseline when onboarding new cloud subscriptions.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

This guide details the exploitation of the Active Directory Certificate Services (AD CS) ESC1 vulnerability. By leveraging misconfigurations, an attacker can request certificates impersonating high-privileged users (e.g., Domain Admins). The workflow covers AD enumeration, forging certificates with arbitrary Subject Alternative Names (SANs), authenticating via PKINIT, and ultimately escalating domain privileges using tools like mimikatz. Essential for authorized red team and penetration testing.

A comprehensive guide for penetration testers detailing methods to identify and exploit misconfigurations in OAuth 2.0 and OpenID Connect (OIDC) flows. Techniques cover redirect URI manipulation, authorization code theft, token leakage via headers, and scope escalation during security assessments.

Learn how to implement robust container security by integrating the open-source Trivy scanner (from Aqua Security) into your CI/CD pipelines. This guide covers scanning container images, Kubernetes manifests, IaC files, and code repositories to detect critical vulnerabilities, misconfigurations, secrets, and generating Software Bill of Materials (SBOM) for comprehensive supply chain security.