Skill UI

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

This skill covers performing comprehensive vulnerability assessments across diverse environments, including on-premises infrastructure, cloud VMs, and container registries. It leverages standard network protocols like SSH (Linux) and WMI (Windows), coupled with advanced cloud provider APIs for analyzing disk snapshots without requiring local endpoint agents. Ideal for security auditing and compliance checks.

Implements a robust, multi-factor model to calculate the criticality score of IT assets. The scoring incorporates data sensitivity, business function dependency, regulatory scope, and network exposure, moving beyond simple CVSS scores. The resulting 1-5 criticality tier directly modifies vulnerability remediation Service Level Agreements (SLAs), ensuring security resources are focused on the organization's most valuable and risky systems.

This guide details how to configure and execute deep, authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM). By utilizing valid credentials (SSH, SMB, or ESXi), users can log into target systems to detect local vulnerabilities, missing security patches, and misconfigurations, which are typically missed by unauthenticated scans. Essential for professional security auditing and penetration testing.

This guide details how to perform authenticated (credentialed) vulnerability scans using industry-leading tools like Nessus, Qualys, and OpenVAS. By utilizing service credentials (SSH, SMB, WinRM, SNMPv3), the scan moves beyond superficial banner checks to deeply inspect installed patches, configurations, and local system settings on Linux, Windows, and network devices. This is crucial for detecting vulnerabilities that unauthenticated scans often miss, significantly improving security assessment accuracy.

A comprehensive toolkit for analyzing ELF binaries to locate memory-corruption vulnerabilities, such as buffer overflows and ROP chains. This skill is vital for authorized penetration testing and CTF challenges, allowing users to evaluate compiler mitigations (ASLR, NX, Canary, PIE) and develop robust proof-of-concept exploits.

A comprehensive skill covering container security vulnerability scanning using Trivy. It detects vulnerabilities in OS packages, language dependencies, IaC misconfigurations, and exposed secrets across container images, Kubernetes manifests, and Git repositories. Features include generating SBOMs (CycloneDX/SPDX) and integrating security gates into CI/CD pipelines for robust supply chain security.

This skill provides a comprehensive framework for vulnerability prioritization by combining three crucial data points: CISA's Known Exploited Vulnerabilities (KEV) catalog (confirming real-world exploitation evidence), EPSS scores (predicting exploitation probability), and CVSS metrics (assessing intrinsic severity). It builds a multi-factor prioritization engine to determine the most critical CVEs for immediate remediation, assisting security teams in managing large vulnerability backlogs efficiently.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.

This advanced technique utilizes AFL++, a powerful fork of American Fuzzy Lop, to perform coverage-guided fuzzing on compiled binaries. It instruments targets and systematically mutates input data to explore deep, previously unreached code paths. Ideal for comprehensive security assessments, vulnerability discovery, and rigorous binary compatibility testing, it helps uncover crashes, memory corruption bugs, and security flaws.