Skill UI

A comprehensive guide and workflow for the post-containment phase of incident response. This process details systematic methods for mapping all persistence mechanisms, identifying malware artifacts, removing threats, resetting compromised credentials, and patching initial access vulnerabilities to ensure complete system eradication.

This guide details the end-to-end process for executing authorized phishing simulations. It instructs security teams and red teams on designing realistic social engineering pretexts, setting up credential harvesting infrastructure (using tools like GoPhish), and measuring key metrics such as open rates, click-through rates, and credential submission rates. It is crucial for assessing organizational human security awareness and testing email security controls (e.g., DMARC, SPF, DKIM).

A comprehensive guide and technique set for detecting and exploiting race condition vulnerabilities in web applications. It focuses on bypassing rate limits, exploiting Time-of-Check-to-Time-of-Use (TOCTOU) flaws, and duplicating transactions using advanced methods like Turbo Intruder's single-packet attack. Ideal for security assessments of state-changing operations (e.g., payments, inventory management, coupon redemption).

A comprehensive guide and set of payloads for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities. This skill covers various template engines like Jinja2, Twig, Freemarker, and more, allowing users to achieve Remote Code Execution (RCE) during penetration testing.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

Implements comprehensive security controls for the entire API key lifecycle, including secure generation, hashing, storage, rotation, and revocation. This skill involves designing keys with sufficient entropy, enforcing per-key scoping, setting rate limits, and building automated workflows to prevent leakage and unauthorized access. Essential for robust server-to-server authentication.

Use XM Cyber to continuously map attack paths, uncover choke points, and prioritize the small set of exposures that can threaten critical assets across on-prem, cloud, and hybrid environments.

This skill details how to establish continuous compliance monitoring for AWS resources. It covers deploying managed and custom Config rules aligned with industry standards like CIS and PCI DSS. The workflow includes setting up recording, implementing automated remediation using SSM, and aggregating compliance data across multiple AWS accounts using AWS Organizations. Ideal for security auditing and guardrail deployment.

IAM Permission Boundaries are an advanced AWS security feature used to set the maximum permissions an identity-based policy can grant to an IAM entity (user or role). This allows security teams to safely delegate role creation to developers while strictly enforcing least-privilege principles, preventing unintended privilege escalation.

A comprehensive guide to configuring multi-layered DDoS protection using Cloudflare. This skill covers mitigating volumetric (L3/4) and application-layer (L7) attacks by setting up managed rulesets, Web Application Firewall (WAF) rules, rate limiting, and Bot Management. Ideal for strengthening security architecture and meeting compliance standards.

This guide details the implementation of SPF, DKIM, and DMARC—the three core pillars of email authentication. It provides a comprehensive workflow, including DNS record setup and best practices, to prevent domain spoofing, validate message integrity, and enforce strong anti-phishing policies across your organization's email system. Essential for building robust email security architecture.

This tool guides the deployment and configuration of the Dragos Platform for critical Operational Technology (OT) and Industrial Control System (ICS) network monitoring. It leverages over 600 industrial protocol parsers and advanced threat intelligence to detect sophisticated attacks (e.g., VOLTZITE, GRAPHITE). Use it for building an OT Security Operations Center (SOC), asset discovery, and vulnerability management in industrial settings, integrating alerts with enterprise SIEMs.