Skill UI

A comprehensive guide for authorized red team and penetration testing engagements, detailing techniques that exploit human trust and psychological vulnerabilities. Coverage includes pretexting, vishing, smishing, physical access attacks (e.g., badge cloning, tailgating), USB payload delivery, and OSINT-driven targeting. This methodology maps to key MITRE ATT&CK T-numbers, simulating real-world, multi-vector adversaries to test organizational defenses at the human layer.

A comprehensive methodology covering advanced offensive techniques targeting the software supply chain. This includes exploiting dependency confusion across npm, PyPI, and NuGet, executing build system hooks, tampering with CI/CD pipelines, and compromising container images. It provides detailed PoC patterns and detection guidance for red team operations.

A comprehensive skill set for performing offensive security assessments on TLS/SSL implementations. This includes identifying cryptographic weaknesses (like POODLE, DROWN, Heartbleed), testing for protocol downgrades, analyzing weak cipher suites, and bypassing security controls such as certificate pinning and improper validation. Essential for penetration testers and security engineers to audit network service integrity.

Detailed methodology for achieving NT AUTHORITY\SYSTEM or local Administrator privileges on Windows targets. Covers token impersonation (JuicyPotato, PrintSpoofer), exploiting service misconfigurations, DLL hijacking, UAC bypass techniques, persistent access, and credential harvesting (LSA, DPAPI). Essential toolkit for red team and penetration testing engagements.