Skill UI

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

Conduct comprehensive security assessments for Operational Technology (OT) networks, including SCADA and DCS systems. This skill maps industrial protocols (Modbus, DNP3, OPC UA) and analyzes traffic against the Purdue Model. It is crucial for identifying IT/OT convergence risks, detecting misconfigurations, and ensuring compliance with standards like IEC 62443.

A comprehensive solution for performing Operational Technology (OT) vulnerability assessments using the Claroty xDome platform. It automatically discovers assets, correlates vulnerabilities using CVE and ICS-CERT advisories, and calculates risk scores. This method is designed for compliance requirements (e.g., IEC 62443, NERC CIP) and initial asset risk profiling, relying on passive monitoring and safe querying rather than active scanning or penetration testing.

This skill demonstrates how to craft and inject custom, malformed, or spoofed network packets using tools like Scapy and hping3. It is designed for authorized cybersecurity assessments to rigorously test firewall rules, Intrusion Detection/Prevention Systems (IDS/IPS) signatures, anti-spoofing controls, and overall network stack resilience against protocol anomalies and fragmentation attacks. Use only in controlled, authorized environments.

This comprehensive guide details physical intrusion assessment methodologies, simulating real-world security threats. Techniques covered include tailgating, RFID badge cloning, mechanical lock bypassing, and deploying rogue network devices. It is designed for full-scope red team engagements to evaluate the integrity of physical security controls and map potential paths to network access.

A comprehensive tool for assessing cybersecurity vulnerabilities across power grid infrastructure, including generation, transmission, substations, and EMS/SCADA systems. It focuses specifically on NERC CIP compliance verification, IEC 61850 protocol security (GOOSE/MMS), and synchrophasor (PMU) network defense against advanced threats. Ideal for compliance audits and critical infrastructure security reviews.

Guide for executing a structured ransomware incident response covering detection, containment, eradication, backup recovery, and post-recovery validation, ensuring teams with IR plans and segmented networks can act swiftly.

Provides a structured, comprehensive playbook for managing high-impact ransomware incidents. It guides the response team through initial detection, immediate network containment, detailed damage assessment, recovery decision making (including legal and financial considerations), and secure system restoration. Essential for cybersecurity teams facing active encryption attacks.

This skill automates red team operations using the Covenant C2 framework, providing comprehensive capabilities for authorized adversary simulation. It covers the full attack lifecycle, including listener setup, deploying agents (grunts), executing tasks on compromised hosts, and tracking lateral movement via the Covenant API. Ideal for professional penetration testing and security auditing.

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

Simulates man-in-the-middle (MITM) attacks by stripping SSL/TLS encryption, forcing HTTPS connections to downgrade to insecure HTTP. This skill is designed for authorized penetration testing to validate HSTS enforcement, assess certificate validation mechanisms, and train security teams on detecting cleartext data leakage during a downgrade attack.