Skill UI

A comprehensive guide for conducting authorized database security assessments across various platforms (PostgreSQL, MySQL, MSSQL, Mongo, Redis). Covers critical areas including exposure analysis, authentication, authorization checks, misconfiguration review, and attack chain validation, ensuring non-destructive testing practices are followed.

A comprehensive security assessment skill for identifying vulnerabilities in federated identity systems, including SAML, OIDC, and OAuth 2.0 flows. It covers common misconfigurations, such as signature tampering, PKCE failures, redirect URI issues, and token confusion, ensuring robust SSO implementation.

This tool simulates a senior application security engineer, performing a comprehensive, multi-phase audit. It checks for exposed secrets, prompt injection vectors, dependency vulnerabilities (supporting multiple languages), and critical configuration misconfigurations. It provides a scored, prioritized remediation report, ensuring a robust security posture before deployment.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A comprehensive guide detailing systematic techniques for breaking out of container isolation (Docker, Podman, containerd) into the underlying host operating system. Covers exploiting misconfigurations, abusing privileged modes, manipulating Linux capabilities (CAP_SYS_ADMIN), utilizing namespaces (nsenter), and exploiting known container runtimes CVEs. Essential for penetration testing and security red teaming engagements.

A comprehensive guide covering the full attack lifecycle in Kubernetes. Techniques include service account token theft, RBAC misconfiguration exploitation, kubelet API abuse, pod escape, and cloud metadata compromise across major cloud platforms (AWS, GCP, Azure). Essential for security assessment and penetration testing of cloud-native environments.

A comprehensive guide covering advanced Linux privilege escalation techniques. It details a systematic methodology to move from a low-privilege shell to root, exploiting misconfigurations in SUID/SGID binaries, abusing Linux capabilities, targeting sudo flaws (NOPASSWD), and leveraging kernel or system service vulnerabilities. Essential for red team and penetration testing engagements.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.

This skill performs a defensive, read-only audit of deployed web applications to identify secrets exposed to the browser. It checks for hardcoded API keys, tokens in JavaScript or HTML, publicly accessible configuration files, and security header misconfigurations. It helps ensure compliance with OWASP guidelines by scanning client-side bundles and server responses without exploiting or mutating data.

This skill performs authorized security assessments on cloud, container, and Kubernetes environments. It identifies risks like metadata SSRF, IAM misconfigurations, container escape paths, and RBAC issues. Suitable for security professionals auditing infrastructure within approved scopes using tools like kubectl and trivy.

Scan container images for vulnerabilities and misconfigurations using tools like Trivy, Grype, and Docker Scout. Integrates with CI/CD pipelines and cloud registries (ECR, ACR, GCR) to ensure compliance and security before deployment. Supports filtering by severity and generating SARIF reports.

Offensive security skill for hunting API security misconfigurations: mass assignment, JWT none/algorithm confusion, server-side prototype pollution, and server-side parameter pollution in backend URL construction. Requires explicit written authorization and a controlled lab or target scope.