Skill UI

A specialized workflow guide for comprehensive security testing of REST and GraphQL APIs. It systematically covers critical security aspects such as authentication validation (OAuth2, JWT), authorization checks (IDOR, privilege escalation), input validation (SQL/NoSQL injection), rate limiting enforcement, and secure error handling. Ideal for vulnerability assessment, bug bounty programs, and pre-deployment security audits.

Orchestrates authorized multi-stage penetration testing workflows spanning reconnaissance, initial access, privilege escalation, and lateral movement. Coordinates specialist skills to plan coherent attack paths, manage risk, and generate comprehensive security assessment reports for red team engagements and authorized security assessments.

This skill provides comprehensive techniques for penetrating AWS cloud environments, covering IAM enumeration, privilege escalation, SSRF attacks, S3 exploitation, and Lambda code extraction. It supports red team operations and security assessments with tools like Pacu and Prowler. Requires AWS CLI and Python knowledge.

A comprehensive skill for offensive security testing of cloud IAM across AWS, Azure, and GCP. It guides users through credential identification, read-only validation, and privilege escalation techniques, emphasizing authorized use only.

This skill enables security professionals to conduct authorized assessments on Linux systems, identifying misconfigurations and vulnerabilities that allow privilege escalation from standard users to root. It covers techniques like SUID exploitation, sudo misconfigurations, and cron job hijacking, strictly requiring written authorization and defensive guardrails.

Provides comprehensive techniques for escalating privileges from low-privileged users to root or administrator on Linux and Windows systems, covering sudo, cron, capabilities, token impersonation, and Active Directory attacks for authorized penetration testing.

This skill involves conducting threat modeling using the STRIDE methodology to identify potential security threats, assess risks, and design appropriate security controls. It is essential when designing secure systems, making architectural changes, or preparing for security audits. The process includes analyzing data flows, identifying trust boundaries, and mitigating risks related to spoofing, tampering, repudiation, information disclosure, denial of service, and privilege escalation.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.

Systematic methodologies for discovering and exploiting Windows privilege escalation vulnerabilities in authorized penetration testing, covering service path abuse, AlwaysInstallElevated, token impersonation, unquoted paths and credential harvesting.