Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

Guides users through password hash generator tasks within the Security Fundamentals stack, outlining best practices, secure coding patterns, and validation checks tailored for authentication workflows.

A comprehensive guide to implementing secure secrets management practices for Continuous Integration/Continuous Deployment (CI/CD) pipelines. It covers using industry-leading tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager to securely store, retrieve, and automatically rotate credentials (API keys, database passwords, TLS certificates) without hardcoding them into source code. Includes best practices for least-privilege access and audit logging.

This technique abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller (DC). By exploiting replication rights (e.g., DS-Replication-Get-Changes-All), attackers can dump password hashes for critical accounts, such as KRBTGT and Domain Admins. The extracted hashes are used to forge Golden Tickets, achieving long-term, persistent domain access. This is a critical post-exploitation method used during authorized red team engagements.

This guide details the methodology for conducting internal network penetration tests, simulating an attacker operating from an assumed breach state. It covers initial network reconnaissance, Active Directory enumeration, advanced credential harvesting techniques (e.g., Kerberoasting, Pass-the-Hash), and lateral movement exploitation to determine the full blast radius of a potential breach. Essential for comprehensive security auditing.

Implements Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. This skill guides the hardening of AD privileged access architecture by establishing strict separation between Tier 0, Tier 1, and Tier 2 accounts. It is essential for mitigating advanced threats like pass-the-hash, Kerberoasting, and ensuring compliance with industry standards (NIST 800-53).

A comprehensive guide and framework for detecting attacker lateral movement within enterprise networks. It details the use of network flow analysis (Zeek), authentication log review (Windows Event Logs, Kerberos), and dedicated SIEM correlation rules (Splunk, Elastic) to identify techniques like Pass-the-Hash and RDP hopping. Ideal for threat hunters and security engineers building detection pipelines.

A comprehensive guide and workflow for proactively hunting Pass-the-Hash (T1550.002) attacks. This method involves analyzing NTLM authentication patterns, correlating suspicious logon types, and utilizing EDR/SIEM data (Splunk, CrowdStrike) to scope lateral movement during incident response or threat hunting exercises. Essential for validating security detection coverage.

A comprehensive guide for authorized penetration testing, demonstrating how to identify and exploit critical vulnerabilities in the SMB protocol (e.g., EternalBlue, PrintNightmare). This skill covers network enumeration, lateral movement techniques (Pass-the-Hash, SMB Relay), and post-exploitation activities using Metasploit and Impacket tools to assess enterprise network security posture.

This skill details techniques for exploiting PHP's type juggling vulnerabilities, primarily caused by loose (==) comparison operators. It demonstrates how attackers can bypass authentication mechanisms, defeat magic hash function verifications, and manipulate application logic through controlled type coercion when testing web applications. Ideal for authorized security penetration testing.

This skill teaches authorized users how to perform comprehensive password hash cracking using Hashcat. It covers various attack methodologies, including dictionary, brute-force, and rule-based attacks, and identification of common hash types (e.g., MD5, NTLM, bcrypt). The primary use case is for conducting controlled security assessments and penetration testing to evaluate password strength and compliance with current security policies. Always used under explicit authorization.

A comprehensive skill for Security Operations Center (SOC) teams and incident responders. It detects advanced lateral movement techniques, including Pass-the-Hash, PsExec, WMI, and RDP pivoting, by correlating Windows Security logs, Sysmon data, and network flow records within a SIEM. This capability is mapped to MITRE ATT&CK TA0008 and is essential for tracking an attacker's internal progression after initial compromise. Not intended for external attack detection.