Skill UI

A sophisticated red-teaming tool for authorized security testing, simulating OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID. It demonstrates how attackers can bypass MFA and steal access and refresh tokens by tricking victims into authorizing access via the genuine Microsoft login page. Essential for validating Conditional Access and token protection controls.

This guide details setting up advanced Command and Control (C2) redirectors, acting as protective intermediaries between implant beacons and the hidden team server. It covers using Nginx and Apache for request filtering based on Malleable C2 profiles, layering Let's Encrypt TLS, and implementing advanced OPSEC controls like domain fronting, geo/UA filtering, and decoy diversion. Essential for red-teaming operations requiring high resilience against blue-team detection and takedown.

This skill details advanced red-teaming techniques for forcing machine account authentication using RPC coercion methods (e.g., MS-EFSR, MS-RPRN) via tools like Coercer and PetitPotam. It demonstrates how to complete a coercion-relay chain against Domain Controllers, facilitating NTLM relay attacks against services like AD CS Web Enrollment (ESC8) or LDAP, ultimately aiming for domain compromise. Use only in authorized engagements.

An automated framework for continuous, repeatable red-teaming of LLM applications within CI/CD pipelines. It integrates Promptfoo and DeepTeam to test against recognized vulnerabilities like OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS (e.g., Prompt Injection, Jailbreaks). This ensures that security vulnerabilities do not regress after code or model changes, providing a critical merge-blocking security gate for production LLM apps.

This skill provides comprehensive methods and frameworks to detect sophisticated AI attacks, including model extraction, membership inference, and model inversion, which abuse inference APIs. It focuses on monitoring per-principal query volume, input distribution, and confidence exposure. Use it for securing public or partner inference APIs, or for conducting pre-deployment red-teaming to assess the model's extractability and overall security posture against MITRE ATLAS techniques.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

A specialized, read-only tool designed for penetration testing and red teaming. It performs comprehensive enumeration across AWS and Azure, allowing users to build a deep situational awareness of an environment. Key functions include identifying internet-exposed endpoints, retrieving sensitive secrets, and mapping critical trust relationships (like sts:AssumeRole) necessary for planning lateral movement or privilege escalation.

A comprehensive red-teaming technique for Active Directory Certificate Services (AD CS). This skill utilizes the Certipy toolkit to enumerate and exploit various Certificate Service Configuration (ESC1-ESC16) misconfigurations over LDAP/RPC. It enables attackers to forge privileged certificates and perform PKINIT authentication, escalating a low-level domain foothold to Domain Admin or Domain Controller access during authorized penetration tests.

A comprehensive framework for authorized AWS penetration testing and red-teaming. This skill automates end-to-end cloud exploitation using Pacu, covering session management, deep IAM enumeration, automated privilege escalation scanning, and establishing persistence backdoors. It is designed to assess the full blast radius of compromised cloud credentials.

NetExec is a comprehensive, multi-protocol tool designed for authorized penetration testing and red-teaming. It functions as a 'swiss-army knife' for assessing Windows, Active Directory, and Linux environments. Key capabilities include validating credentials, performing password spraying, enumerating network shares, executing commands across multiple protocols (SMB, WinRM, LDAP, MSSQL, SSH), and dumping critical credentials (SAM, LSA, NTDS). It directly supports techniques for lateral movement and post-exploitation activities.

This skill provides a comprehensive guide to the full lifecycle operation of the Havoc Command and Control (C2) framework. It covers setting up the team server, writing Yaotl profiles, and generating highly evasive Demon agents using sophisticated techniques like indirect syscalls and sleep obfuscation. It is critical for authorized red-team engagements, adversary emulation, and validating EDR detection capabilities.

Sliver is an open-source, cross-platform Command and Control (C2) framework used for adversary emulation in authorized red-team engagements. This skill guides users through deploying the C2 server, establishing multi-protocol listeners (mTLS, DNS, HTTPS), generating cross-platform implants, and executing advanced post-exploitation techniques, including pivoting and in-memory execution via the Armory.