Skill UI

Implement robust Static Application Security Testing (SAST) using CodeQL powered by GitHub Advanced Security (GHAS). This solution automates the detection of critical vulnerabilities (e.g., SQL injection, XSS) across large, enterprise-scale codebases, ensuring compliance and maintaining a strong DevSecOps posture throughout the development lifecycle.

This skill provides comprehensive knowledge on using JSON Web Tokens (JWT) for secure authentication and authorization. It covers implementing various cryptographic signing algorithms (such as HS256, RS256, ES256, and EdDSA), validating signatures, enforcing claim constraints (like expiration time), and implementing robust defenses against common JWT vulnerabilities, including algorithm confusion and the 'none' algorithm attack. Ideal for building secure, scalable web APIs.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

This skill defines the process and framework for establishing mandatory Service Level Agreements (SLAs) for mitigating identified vulnerabilities. It guides users on how to calculate remediation timeframes based on vulnerability severity (CVSS, KEV), asset criticality (Tier 1, 2, 3), and exploit availability. The process includes setting up escalation chains, defining exception processes, and tracking key performance indicators (KPIs) like Mean Time to Remediate (MTTR) to ensure robust security governance and compliance.

This skill implements an automated system to monitor and alert on vulnerabilities that exceed their defined remediation Service Level Agreements (SLAs). It supports severity-based timelines, complex escalation workflows (e.g., PagerDuty, email), and generates comprehensive compliance reports, ensuring continuous adherence to security best practices.

A comprehensive guide for intercepting and analyzing HTTP/HTTPS traffic from mobile applications using Burp Suite. This skill walks through configuring proxies on Android and iOS, handling CA certificate installation, and executing advanced penetration testing techniques. It is essential for assessing API security, identifying data leakage, and finding authentication vulnerabilities in mobile client-server communications.

This comprehensive guide provides essential security protocols for building robust Laravel applications. It covers best practices for authentication (Sanctum, Passport), authorization (Policies), input validation, and protecting against common vulnerabilities like CSRF, XSS, and SQL injection. Key topics include secure file uploads, rate limiting, environment variable management, and implementing robust middleware.

This skill systematically enumerates and audits Active Directory forest trust relationships using advanced techniques like SID filtering analysis, detecting SID history abuse, and assessing inter-realm Kerberos ticket configurations. It is designed for red-teaming and security auditing to identify potential lateral movement paths and trust vulnerabilities across organizational boundaries.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

Use RESTler to automate stateful security testing of REST APIs. It processes OpenAPI specifications to generate fuzzing grammars, allowing users to discover complex bugs, such as injection vulnerabilities, resource leaks, and unhandled exceptions (500 errors), by executing diverse sequences of API calls. Essential for robust CI/CD regression testing and proactive API security assessments.

This tool simulates advanced security testing to identify vulnerabilities in API rate limiting. It bypasses throttling controls by manipulating request headers (like X-Forwarded-For spoofing), varying source IP addresses, and manipulating endpoint paths. Essential for assessing API resilience against brute-force attacks, credential stuffing, and resource exhaustion, aligning with OWASP API Security guidelines.

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.