Skill UI

Conducts a comprehensive Active Directory penetration test, covering domain enumeration, misconfiguration discovery, and attack path analysis using BloodHound. Techniques include exploiting Kerberos weaknesses (Kerberoasting, AS-REP Roasting) and escalating privileges via DCSync and constrained delegation, culminating in domain compromise demonstration.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

This tool performs comprehensive API inventory and discovery across an organization's environment. It identifies all API endpoints—including documented, undocumented, shadow, and deprecated APIs—by combining passive traffic analysis (HAR files), active scanning, DNS enumeration, and cloud resource auditing. It helps map the complete API attack surface, crucial for security assessments and compliance requirements like PCI-DSS and SOC2.

This guide details how to use OpenVAS/Greenbone Vulnerability Management (GVM) to perform authenticated vulnerability scans. By utilizing valid credentials (SSH for Linux, SMB for Windows), scans can log into target systems, detecting deep local vulnerabilities, missing patches, and misconfigurations far beyond what unauthenticated scans can find. This is essential for comprehensive security assessments and compliance auditing.

This guide details authenticated (credentialed) vulnerability scanning, which uses valid system credentials (SSH keys, domain passwords, etc.) to log into target hosts. Unlike external scanning, credentialed methods allow deep inspection of installed patches, local configurations, registry keys, and system files across diverse platforms (Linux, Windows, Network Devices). This significantly increases vulnerability detection rates and reduces false positives for comprehensive security assessments.

This guide details the methodology and tools for conducting authorized privilege escalation assessments within AWS environments. It systematically utilizes specialized tools like Pacu and Principal Mapper (PMapper) to identify critical IAM misconfigurations, excessive permissions, and weak cross-account trust relationships. It is essential for validating the principle of least privilege and assessing the potential blast radius of compromised credentials during authorized penetration testing.

This skill simulates various network attack scenarios, including bandwidth throttling, traffic shaping, and network degradation, using tools like tc, iperf3, and Scapy. It is designed for authorized security assessments to test the resilience of applications, validate Quality-of-Service (QoS) policies, and assess the ability of network monitoring tools to detect sophisticated traffic manipulation attacks (e.g., Slowloris-style attacks).

This comprehensive guide details the methodology for detecting and exploiting Blind Server-Side Request Forgery (SSRF) vulnerabilities. It covers crucial techniques including out-of-band (OOB) detection, internal network enumeration (port scanning, IP scanning), accessing cloud metadata endpoints (AWS, GCP, Azure), and bypassing common security filters using various encoding and parsing confusion methods. Ideal for penetration testing and cloud security assessments.

This skill assesses Bluetooth Low Energy (BLE) device security by scanning nearby devices, enumerating GATT services, and analyzing characteristics. It detects critical vulnerabilities such as unencrypted sensitive data exposure, weak pairing configurations, and known vulnerable device fingerprints, making it essential for IoT and medical device security auditing.

This skill guides users on performing deep runtime threat detection and forensics in cloud-native environments using Falco. It leverages Falco YAML rules to monitor syscalls, detecting critical security events such as shell spawning, file tampering (e.g., /etc/shadow), network anomalies, and privilege escalation within containers and Kubernetes clusters. Ideal for incident response, security auditing, and validating container runtime security controls.

A comprehensive guide and workflow for performing authorized penetration testing on AWS environments using the open-source Pacu framework. This skill covers enumerating IAM configurations, identifying privilege escalation paths, testing credential harvesting, and validating security controls across S3, EC2, Lambda, and Secrets Manager. It is designed for red team exercises and risk assessment when auditing cloud infrastructure security.

A comprehensive tool for auditing container security posture by detecting potential escape vectors. It analyzes Kubernetes Pod specs for dangerous configurations, such as running in privileged mode, dangerous capability assignments (like CAP_SYS_ADMIN), host namespace sharing, and writable hostPath mounts. Ideal for security assessments and incident response to prevent container breakout.