Skill UI

This specialized skill guides users through analyzing complex Active Directory Certificate Services (AD CS) abuse scenarios. It is essential for proving how a weakness in a template, CA policy, or issuance right can lead to unauthorized privilege acceptance (e.g., via PKINIT, Schannel). The workflow focuses on mapping the entire certificate issuance chain to the resulting accepted service path.

A specialized skill for analyzing client-side persistence mechanisms, including cookies, localStorage, sessionStorage, IndexedDB, and Service Workers. It is crucial for security testing and CTF environments where application behavior or critical decision branches are determined by stored session state, cached data, or local client-side variables. Use this to trace the smallest stateful sequence leading to a decisive outcome.

This specialized skill is designed for advanced security analysis, tracing the complete trust chain from cloud metadata services to accepted privilege. It is used in penetration testing or CTF environments to meticulously prove how metadata-derived credentials (such as instance identities or tokens) are issued and subsequently accepted by a cloud or control plane API, thereby exposing the decisive trust edge.

This specialized skill is designed for in-depth security and forensic analysis of Windows secrets protected by DPAPI. It maps the entire lifecycle of encrypted credentials, tracing the flow from the initial protected blob or masterkey through the context unwrapping (e.g., user logon, machine context, domain backup keys) to the specific service that finally accepts the plaintext secret. Use this to prove the decisive access edge in a complex compromise scenario.

This skill is designed for deep security and behavioral analysis within the Kubernetes control plane. It specializes in tracing complex interactions, including RBAC edge cases, service-account trust paths, admission webhook behavior, resource mutation, and cluster-level state drift. Use it when diagnosing why live workloads differ from manifest declarations, or when investigating cluster-wide permission issues.

A highly specialized skill for advanced security analysis, designed to trace complex Kerberos delegation chains (including constrained, unconstrained, and RBCD). Use this skill to pinpoint the exact delegation edge, analyze ticket minting (S4U), and prove the effective privilege gained by a target service, going beyond simple domain compromise statements.

This specialized skill is designed for deep forensic analysis of compromised Linux environments, specifically tracing the sequence of credential usage (tokens, keys, service accounts) that leads to lateral movement or privilege escalation. It helps map the decisive path from a recovered artifact to an accepted replay mechanism, identifying the exact trust edge or capability abuse responsible for the host-to-host pivot.

This specialized skill is designed to trace and prove the complete flow of OAuth or OIDC authentication, acting as a downstream specialization after an orchestrator has established sandbox assumptions. It meticulously tracks the entire journey—from initial redirect and parameter handling (state, nonce, PKCE) through token exchange, claim mapping, and ultimately to the point where an identity or privilege is accepted by the backend service. Use this when the critical task is proving the security and mechanics of the authentication chain.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.

A comprehensive guide for designing and building large-scale, resilient platforms using the evolutionary modular monolith approach. It enforces strong logical boundaries using DDD principles (bounded contexts, flat-by-aggregate) and implements necessary patterns like Anti-Corruption Layers and transactional outboxes. Use this when defining a system's structure, choosing between monolith and microservices, or ensuring robust decoupling from external vendors (e.g., ERP, AI).