Skill UI

An expert playbook detailing advanced techniques for pivoting across compromised Linux hosts. Techniques cover SSH agent hijacking, credential harvesting from common system files, key extraction, and abusing internal services via D-Bus and systemd exploitation, crucial for post-exploitation stages.

A comprehensive playbook detailing advanced techniques for post-exploitation security bypass on Linux systems. Covers escaping restricted shells (rbash), evading noexec/read-only filesystems using in-memory execution (DDexec, memfd_create), and circumventing mandatory access controls like AppArmor and SELinux. Essential for penetration testing and red team operations.

A comprehensive methodology for exploiting Time-of-Check / Time-of-Use (TOCTOU) race conditions across diverse system layers. This covers symlink swaps, file-descriptor races, kernel double-fetch vulnerabilities, and advanced window-widening primitives like FUSE slow filesystems and userfaultfd. Essential for security researchers targeting race-based privilege escalation in binaries, kernels, and container orchestrators.

This advanced playbook covers escalating prototype pollution into Remote Code Execution (RCE) and Cross-Site Scripting (XSS). It details exploitation techniques across various environments, including Node.js child_process, EJS, Pug, Handlebars, and client-side libraries like jQuery and Lodash. It is designed for security researchers and penetration testers to systematic locate and exploit deep merge sinks and framework gadgets.

A comprehensive and advanced playbook for mastering SQL injection techniques. It covers critical areas including WAF bypass, out-of-band data exfiltration, second-order injection, and exploitation strategies across major database systems (MySQL, MSSQL, Oracle, PostgreSQL). Essential for professional penetration testing and security auditing.

This specialized downstream skill is designed for deep analysis of complex attack paths originating from Server-Side Request Forgery (SSRF). It systematically tracks the entire exploitation chain: from the initial SSRF source (e.g., webhook, URL parameter) through internal service reachability, metadata endpoint exploitation, credential extraction, and finally, demonstrating how an attacker achieves accepted access or elevated privileges. Use this when tracing the decisive path through server-side requests and credential pivoting.

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

A comprehensive firmware and IoT penetration testing skill following OWASP FSTM. Covers firmware acquisition, static analysis, file system extraction with binwalk/unblob, automated EMBA scanning, system emulation via Firmadyne/QEMU, dynamic debugging, and binary exploitation for ARM/MIPS devices. Ideal for auditing routers, cameras, smart home devices, reproducing IoT CVEs, and discovering embedded 0-days.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A systematic methodology for performing offensive cryptographic analysis. This skill focuses on identifying and exploiting flaws arising from the misuse of cryptographic primitives in real-world applications, rather than breaking the underlying math. Techniques covered include Padding Oracle Attacks (CBC), ECB block manipulation, Hash Length Extension, RSA weaknesses, and PRNG exploitation. Ideal for penetration testing and deep security auditing.

A deep-dive methodology for authorized penetration testing targeting dependency confusion and namespace resolution vulnerabilities across major package ecosystems (npm, PyPI, NuGet, Maven, etc.). This skill details advanced reconnaissance techniques, from analyzing lock files and source maps to exploiting error messages, alongside safe Proof-of-Concept (PoC) creation using DNS canaries for discovery during penetration engagements.

A practical methodology for turning a known vulnerability into a stable working remote exploit. Covers stack overflow, heap exploitation, and Linux kernel pwn, addressing real-world gaps between local CTF success and reliable remote execution: libc version mismatches, heap spray timing, SMEP/SMAP/KASLR, stack alignment, and network buffering. Uses pwntools with GEF/pwndbg, ROPgadget/Ropper, one_gadget, libc-database, and qemu-system.