Skill UI

A specialized security testing skill designed to identify excessive data exposure in REST or GraphQL APIs, adhering to OWASP API3:2023 guidelines. It works by intercepting raw API responses and systematically comparing the returned data against what the frontend UI actually displays. This helps auditors detect leaked PII, internal identifiers, debug fields, or other sensitive business data that should have been filtered out by the endpoint response. Use cases include auditing microservice boundaries, assessing mobile API responses designed for multiple clients, and verifying proper respons...

This guide provides a comprehensive methodology for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. It teaches testers how to systematically manipulate object identifiers (such as numerical IDs, UUIDs, or slugs) within API requests and URLs. Techniques involve using advanced tools like Burp Suite's Authorize extension to test object-level access control, validating both horizontal (same privilege) and vertical (different privilege) access restrictions during authorized penetration tests or bug bounty engagements.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This skill provides a systematic methodology for detecting Command and Control (C2) beaconing patterns in network traffic. It utilizes advanced statistical techniques, including Coefficient of Variation (CV) and jitter analysis, applied to network flow logs (Zeek, proxy, firewall). It is crucial for proactive threat hunting and incident response to identify compromised endpoints communicating periodically with malicious infrastructure.

This guide provides a systematic methodology for proactive threat hunting targeting Living-off-the-Land Binaries (LOLBins). Attackers misuse legitimate, signed system binaries (like certutil or rundll32) to execute malicious payloads or download files, effectively bypassing traditional security controls and application allowlisting. Use this framework when establishing EDR/SIEM detection rules or when investigating advanced, fileless defense-evasion techniques.

This skill provides a structured methodology for mitigating alert fatigue within Security Operations Centers (SOCs). It guides users through advanced techniques, including implementing Risk-Based Alerting (RBA) to replace high-volume, low-fidelity alerts with consolidated risk scores. It emphasizes quantifying alert quality by analyzing True Positive (TP) and False Positive (FP) rates, and systematically tuning detection rules to maintain analyst effectiveness.

This methodology provides SOC teams with an adversary-centric framework to evaluate security detection capabilities against the MITRE ATT&CK framework. By systematically mapping existing SIEM rules and data sources, users can identify critical detection gaps, prioritize rule development efforts, and measure the overall maturity of their security operations center (SOC) defenses over time.

This guide details the systematic workflow for patch management, covering the entire lifecycle from vulnerability discovery and risk assessment to controlled testing, multi-phased deployment, and final verification. Learn how to integrate tools like WSUS, SCCM, and Ansible into a robust, automated process to significantly reduce the attack surface and ensure compliance across enterprise IT infrastructure.

This skill guides security teams on systematically tuning SIEM detection rules in platforms like Splunk and Elastic. It focuses on reducing alert fatigue and false positives by analyzing historical alert volumes, establishing environmental baselines, creating context-aware whitelists, and measuring detection efficacy using metrics like precision and recall. This is crucial for maturing a Security Operations Center (SOC).

This skill guides the systematic process of conducting access reviews and certifications. It covers designing review campaigns, risk-based prioritization (e.g., privileged access), reviewer assignment, and remediation tracking. Essential for maintaining compliance with major regulations like SOX, HIPAA, and PCI DSS, ensuring user access strictly matches their job roles.

A comprehensive guide detailing the systematic process of security alert triage within Elastic Security SIEM. Learn how to classify, prioritize, and investigate potential threats using Kibana, advanced ES|QL queries, and ECS-normalized data. This workflow is crucial for SOC analysts to rapidly determine true positives, manage alert queues, and ensure effective incident response.

This guide details the methodology and tools for conducting authorized privilege escalation assessments within AWS environments. It systematically utilizes specialized tools like Pacu and Principal Mapper (PMapper) to identify critical IAM misconfigurations, excessive permissions, and weak cross-account trust relationships. It is essential for validating the principle of least privilege and assessing the potential blast radius of compromised credentials during authorized penetration testing.