Skill UI

A comprehensive framework for setting up and processing Linear webhooks. This skill demonstrates best practices for real-time event handling, including mandatory HMAC signature verification, replay attack prevention, and robust event routing for various data types (Issues, Comments, Projects). Ideal for building reliable, real-time integrations between Linear and external systems.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

A comprehensive skill for conducting authorized Bluetooth Low Energy (BLE) security assessments. It covers detecting various attacks, including sniffing, Man-in-the-Middle interception, replay attacks, and GATT enumeration abuse. The workflow guides users through packet capture using specialized sniffers (Ubertooth, nRF Sniffer), analyzing services and characteristics via Python/bleak, and performing cryptographic analysis using tools like crackle.

This comprehensive guide outlines best practices for securing SalesLoft API access and integrations. It details secure token lifecycle management (OAuth refresh), implementing robust webhook signature verification using HMAC-SHA256 to prevent replay attacks, and enforcing scope minimization for least-privilege access. Use this when designing production-grade, secure enterprise integrations.

Methodology for capturing, analyzing, and replaying LoRaWAN and sub-GHz wireless traffic. Useful for testing IoT deployments, fixed-code remotes, garage doors, TPMS, and other devices in 433/868/915 MHz bands.

Covers offensive workflows for Zigbee, Thread, and Matter mesh networks, including 802.15.4 sniffing, commissioning abuse, key capture, replay/injection, and control-command exploitation in smart-home deployments.

A comprehensive guide detailing attack methodologies for Z-Wave smart home networks. Techniques covered include sniffing during inclusion (S0/S2), exploiting key derivation flaws, performing replay attacks on unauthenticated nodes, and crucial hub compromise (pivoting) to gain full control over the entire mesh network. Essential reading for IoT penetration testing.

A comprehensive guide for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically focusing on Microsoft Entra ID (Azure AD). This covers advanced threats like Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Adversary-in-the-Middle (AitM) phishing. Use it for investigating anomalous sign-in behavior, configuring risk-based conditional access policies, and enforcing token protection to secure cloud identities.

A comprehensive guide for threat hunting and detection engineering focused on identifying SSO and OAuth token abuse. It detects 'pass-the-cookie' and session replay attacks where attackers use stolen tokens (like cookies or refresh tokens) to move laterally across federated SaaS platforms (Entra ID, Okta) without needing credentials. Essential for post-incident scope analysis and validating T1550.001 coverage.