Skill UI

An open-source tool based on the CIS Docker Benchmark. It systematically audits critical security aspects of Docker deployments, including host configuration, daemon settings, and container runtime. It generates a detailed compliance report (pass/fail/warn) to ensure best practices and security compliance in production environments.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This tool performs comprehensive security testing on GraphQL APIs by generating deeply nested, recursive, or highly repetitive queries. It specifically aims to identify Denial-of-Service (DoS) vulnerabilities and resource exhaustion issues by overwhelming the server's CPU, memory, or database connections. Essential for security auditors and penetration testers.

A comprehensive guide for systematically evaluating Kubernetes cluster security. It simulates advanced attacker techniques against critical components like the API server, etcd, kubelet, RBAC, and network policies, identifying misconfigurations and vulnerabilities. Essential for security auditors, penetration testers, and DevOps teams performing deep cluster security assessments.

This comprehensive guide outlines the end-to-end workflow for mobile device forensics, covering data acquisition and analysis for both iOS and Android platforms. It details techniques using commercial tools like Cellebrite UFED and open-source utilities (ALEAPP, iLEAPP, ADB). This methodology is critical for investigating deleted messages, call logs, location data, and application artifacts in legal or corporate investigations.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

This tool orchestrates safe vulnerability assessments for Operational Technology (OT) and Industrial Control Systems (ICS) environments. It prioritizes safety by guiding users through passive monitoring, native protocol querying, and carefully controlled active scanning methods, specifically designed to identify vulnerabilities without risk of disrupting industrial processes or crashing legacy controllers. Essential for compliance audits (e.g., IEC 62443).

This guide facilitates comprehensive tabletop exercises simulating major ransomware incidents. It systematically tests an organization's preparedness, decision-making processes, and communication protocols across executive, legal, PR, and technical teams. Scenarios cover double extortion, regulatory compliance (GDPR, HIPAA), and varying backup compromise levels, helping organizations identify critical gaps before a real-world attack.

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

This skill guide provides a comprehensive framework for automating the secure rotation of service account credentials. It addresses the challenge of managing long-lived secrets across diverse environments, including Active Directory, AWS, GCP, Azure, and databases. By implementing centralized secrets management (like HashiCorp Vault) and automated workflows, users can systematically eliminate stale credentials, dramatically reducing the risk of security breaches and non-compliance.

A comprehensive guide for performing static analysis of Windows Portable Executable (PE) files using tools like PEStudio and scripting libraries. This technique examines file headers, calculates section entropy, identifies suspicious API calls (e.g., process injection, persistence), and extracts obfuscated strings and Indicators of Compromise (IoCs) without executing the sample, making it a crucial step in malware triage and reverse engineering.

This skill demonstrates how to use PyMISP, the official Python library, to programmatically interact with the MISP threat intelligence platform. Users can create, enrich, and manage structured threat events, including adding Indicators of Compromise (IOCs), applying TLP/MITRE ATT&CK tags, and exporting data in STIX 2.1 format for cross-platform sharing, making it ideal for security assessments and incident response.