Skill UI

This tool facilitates interactive dynamic malware analysis using the ANY.RUN cloud sandbox. It allows analysts to detonate suspicious samples, observe real-time execution behavior, and manually interact with prompts (like dialogs or CAPTCHAs). Key outputs include detailed process trees, network traffic analysis (C2 communication), and identification of all Indicators of Compromise (IOCs), mapping observed behaviors to MITRE ATT&CK. Essential for rapid, sophisticated behavioral analysis without maintaining local sandbox infrastructure.

Automates deep packet inspection using tshark and pyshark on PCAP files. This tool is designed for cybersecurity professionals to perform structured network forensics, compute protocol distribution, detect suspicious activity (like port scans, beaconing, and data exfiltration), extract critical IOCs (IPs, domains, URLs), and identify advanced threats such as DNS tunneling patterns. Ideal for incident response and security auditing.

Zeek is a powerful, open-source network analysis framework that functions as a passive security monitor. It generates highly detailed, structured logs (e.g., HTTP, DNS, TLS) from raw network traffic, allowing for deep metadata extraction. This skill guides users through deploying Zeek, writing custom detection scripts, and integrating the resulting rich security logs with SIEM platforms for advanced threat detection and forensic investigations.

A specialized analyzer designed to examine Siemens S7comm and S7CommPlus protocol traffic. It helps security professionals assess the security posture of SIMATIC S7 PLCs, detecting vulnerabilities such as unauthorized program downloads, PLC stop commands, and potential integrity bypasses in Operational Technology (OT) environments.

This tool monitors Modbus TCP communication within SCADA and ICS environments to detect security anomalies. It performs deep packet inspection, baselines normal communication patterns (e.g., typical function code distribution, register access), and applies statistical analysis to identify unauthorized register writes, reconnaissance attempts, or denial-of-service attacks targeting industrial control devices.

This comprehensive skill provides a systematic framework for performing deep security assessments on iOS applications. It covers static analysis of IPA packages, dynamic instrumentation using Frida and Objection, SSL pinning bypass for traffic interception, extraction and auditing of sensitive data from the Keychain, and runtime method hooking. Use this for authorized penetration testing against standards like OWASP MASTG.

A sophisticated skill for detecting Command and Control (C2) traffic tunneled through DNS protocols. It utilizes advanced techniques like Shannon entropy analysis of subdomains, Machine Learning for DGA classification, and correlation with network logs from Zeek/Suricata. Ideal for SOC analysts and threat hunters investigating data exfiltration, DNS beaconing, or suspicious DNS activity.

This expert playbook details advanced techniques for bypassing SSL pinning mechanisms (Certificate, Public Key, SPKI) on mobile applications running on Android and iOS. It provides practical methods using tools like Frida and Objection, covering various frameworks (Flutter, React Native, Xamarin) and multiple pinning types to enable the interception and analysis of encrypted HTTPS traffic.

A comprehensive, advanced playbook for conducting deep network traffic analysis and PCAP forensics. Covers essential skills like PCAP repair, advanced Wireshark filtering (HTTP, DNS, TLS), data extraction (file carving, credential harvesting), and detecting covert channels. It guides users through sophisticated techniques, including TLS decryption workflows and DNS tunneling identification.

Direct access to Google's SEO APIs including Search Console, PageSpeed Insights, CrUX field data, Indexing API, and GA4 organic traffic. Provides real-time field data for Core Web Vitals, indexation status, search performance, and organic traffic trends. Use for SEO analysis, website performance monitoring, and search optimization.

A comprehensive skill for detecting and analyzing malicious behavior in mobile applications (Android/iOS). It employs multi-layered security analysis, including static indicator checking (permissions, manifest), dynamic instrumentation (Frida), network traffic monitoring, and automated scanning (MobSF). Use this skill when investigating suspicious apps for data exfiltration, C2 communication, or unauthorized access.

A comprehensive tool for deep marketing performance analysis. This skill guides users in defining robust KPI frameworks, building attribution models, investigating traffic anomalies, and developing advanced measurement strategies. It is essential for modern digital marketing, including handling AI-generated traffic, dark social attribution, and cookieless privacy environments.