Skill UI

CAPE is an open-source sandbox derived from Cuckoo, designed for automated dynamic malware analysis. It features advanced behavioral instrumentation, capturing system changes, network traffic (PCAP), and specialized parsers to extract malware configurations (e.g., Emotet, Cobalt Strike). Use this skill for incident response, security assessments, and validating security controls against complex payloads and evasion techniques.

This skill outlines the systematic process of integrating new data sources (e.g., Firewalls, EDR, Cloud, AD) into a SIEM platform. It covers planning, configuring collectors, building parsers, normalizing data fields (e.g., CIM), and validating data quality to enhance security monitoring and incident detection capabilities.

A comprehensive guide detailing advanced offensive fuzzing methodologies. It covers the full lifecycle from target identification (parsers, network protocols, kernels) to tool selection (AFL++, libFuzzer, Honggfuzz, syzkaller), building harnesses, curating seed corpora, executing fuzz campaigns, and finally, performing crash triage and vulnerability analysis. Essential for security researchers and embedded systems developers.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This router serves as the main entry point for comprehensive injection testing. It helps security professionals classify dangerous input flows—such as XSS, SQLi, SSRF, XXE, etc.—by determining the final sink or interpreter (e.g., browser context, database, XML parser, shell). Use it when unsure which specific injection vector to prioritize.

This utility reads the raw content of a UTF-8 text file and emits it verbatim to stdout. It is specifically designed for meta-skills that require round-tripping an artifact through disk, allowing users to manually edit structured files (like scripts or YAML) during review pauses. Unlike standard built-in readers that add line numbering, this method preserves the original bytes, making it suitable for downstream parsers.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.

This specialized skill traces the complete lifecycle of an uploaded or imported file through complex backend systems. It maps the sequence from ingress to final consumer, tracking every derived artifact, archive extraction, format conversion, parser invocation, and deserialization step. It is crucial for security analysis, vulnerability research, and understanding how a file reaches a decisive backend effect after initial sandbox assumptions are made.