Skill UI

This skill covers the comprehensive automation of X.509 certificate lifecycle management, including requesting, issuing, deploying, monitoring, renewing, and revoking certificates. Utilizing Python and the ACME protocol (like Let's Encrypt), it helps organizations mitigate security risks and prevent service outages caused by expired or poorly managed certificates. Ideal for security auditing, incident response, and continuous security testing.

This skill provides a comprehensive method for assessing SSL/TLS server configurations using the powerful Python library, sslyze. It evaluates crucial security aspects including supported protocol versions (e.g., TLS 1.2, 1.3), cipher suite strength, certificate chain validity, HSTS enforcement, and checks for common vulnerabilities like Heartbleed and ROBOT. Ideal for penetration testing, security auditing, and incident response.

Guides penetration testers through identifying CORS misconfigurations on web APIs, validating origin handling, preflight responses, and crafting PoCs to prove sensitive data can be accessed cross-origin during authorized assessments.

Define and run penetration-test steps that hunt for exposed secrets, PII, and over-shared API responses while validating encryption and secure storage for sensitive assets.