Skill UI

Leverages Monte Carlo-based simulation to spot potential software vulnerabilities by feeding randomized inputs into modules, tracking failure likelihoods, and highlighting risky code paths for security testing.

Establishes a repeatable, structured operational process for managing Microsoft Patch Tuesday security updates. The workflow guides users through advisory review, vulnerability triaging (including zero-days), phased testing, and deployment across major platforms (Windows, Azure, Office). Ideal for maturing patch management programs and defining risk-based remediation SLAs.

This script automates the detection and exploitation of Broken Function Level Authorization (BFLA) in APIs, following OWASP API Top 10 guidelines. It simulates low-privilege users attempting to access or modify restricted administrative endpoints (e.g., user management, system settings) using techniques like role switching, path manipulation, and parameter tampering. Essential for assessing vertical privilege escalation risks and verifying robust Role-Based Access Control (RBAC).

A comprehensive guide to using the Metasploit Framework for advanced penetration testing and vulnerability validation. This skill details how to confirm exploitability of identified CVEs, gather post-exploitation evidence, and validate patch remediation effectiveness. It is essential for risk-based vulnerability management and red team exercises, providing proof of real-world impact beyond simple scanner scores.

Provides a structured, risk-based framework for managing patches in Operational Technology (OT) and Industrial Control Systems (ICS). It addresses the critical difference between IT and OT environments, prioritizing safety and availability over immediate remediation. The guide covers risk scoring, vendor compatibility testing, staged deployment, and defining compensating controls for unpatchable assets.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This skill reviews test suite quality using established testing literature to identify brittleness, mock abuse, unclear fixtures, weak assertions, slow feedback, and maintenance risks. It diagnoses structural problems in existing test suites based on classic engineering books like xUnit Test Patterns and The Art of Unit Testing, ensuring robust and maintainable testing practices.