Skill UI

This skill guides the detection and recovery of exposed version-control system (VCS) metadata, including paths for Git, SVN, and Mercurial, as well as common backup and configuration files. It is essential for authorized penetration testing when assessing an application's security posture against information leaks. Techniques include probing specific directories (e.g., /.git/HEAD) and analyzing status codes (e.g., 403 vs 404) to confirm exposure.

A comprehensive playbook detailing advanced techniques for attacking Kubernetes clusters. Covers API server access, RBAC privilege escalation, service account token abuse, etcd secrets extraction, Kubelet exploitation, and various container escapes. This guide is essential for security professionals and red teams performing deep security assessments on cloud-native infrastructure.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

A comprehensive playbook detailing advanced techniques for bypassing core macOS security features, including TCC, Gatekeeper, SIP, and sandbox restrictions. This guide is essential for authorized red team operations and penetration testing targeting macOS endpoints, covering methods like direct database manipulation, extended attribute removal, and privilege escalation paths.

A comprehensive guide detailing various 802.11 management frame attacks, including deauthentication and disassociation. It covers targeted single-client deauth for handshake capture, broadcast DoS attacks, and advanced action-frame exploitation to bypass PMF (802.11w). Essential for professional penetration testing and wireless vulnerability assessment.

A comprehensive guide detailing attack methodologies for Z-Wave smart home networks. Techniques covered include sniffing during inclusion (S0/S2), exploiting key derivation flaws, performing replay attacks on unauthenticated nodes, and crucial hub compromise (pivoting) to gain full control over the entire mesh network. Essential reading for IoT penetration testing.

A comprehensive playbook for professional bug bounty hunting and penetration testing. This guide covers systematic reconnaissance, from initial asset discovery (subdomains, IPs) and technology fingerprinting to advanced endpoint and source code mining. Learn the structured methodology used by top hunters to maximize coverage and find high-severity vulnerabilities.

A comprehensive and advanced playbook for mastering SQL injection techniques. It covers critical areas including WAF bypass, out-of-band data exfiltration, second-order injection, and exploitation strategies across major database systems (MySQL, MSSQL, Oracle, PostgreSQL). Essential for professional penetration testing and security auditing.

This playbook provides expert-level techniques for cryptanalysis of symmetric encryption. It details how to exploit weaknesses in various modes and algorithms, including CBC padding oracle attacks, ECB mode exploitation, bit flipping attacks, stream cipher key reuse, and meet-in-the-middle attacks. Essential for authorized penetration testing and CTF challenges.

This playbook provides expert-level techniques for exploiting common infrastructure services that are exposed without proper authentication. Coverage includes Redis RCE, Rsync data theft, PHP-FPM code execution, AJP file reads, and MongoDB/Hadoop vulnerabilities. Essential for deep penetration testing and security auditing.

An expert-level playbook covering non-obvious XSS techniques, advanced payload selection across various sinks (DOM, SVG, HTML attributes, JavaScript), and sophisticated defense bypass strategies. Use this guide for real-world penetration testing, including WAF bypass, CSP bypass, HttpOnly bypass, and XS-Leaks side channel exploitation. It assumes deep knowledge of web vulnerability mechanics.

A specialized, read-only tool designed for penetration testing and red teaming. It performs comprehensive enumeration across AWS and Azure, allowing users to build a deep situational awareness of an environment. Key functions include identifying internet-exposed endpoints, retrieving sensitive secrets, and mapping critical trust relationships (like sts:AssumeRole) necessary for planning lateral movement or privilege escalation.