Skill UI

A deep-dive playbook covering expert techniques for Path Traversal and Local File Inclusion (LFI). It details multiple bypass methods (encoding, null bytes, wrappers), target file enumeration on Linux and Windows, and advanced Remote Code Execution (RCE) escalation paths, such as log poisoning via PHP wrappers.

A comprehensive playbook detailing advanced techniques for establishing and maintaining remote command-line access. Covers foundational knowledge like reverse vs. bind shells, encrypted communication methods (OpenSSL, socat), web shell implementation (PHP, ASPX, JSP), PTY upgrading for interactivity, robust file transfer methods (Linux/Windows), and advanced PowerShell payloads.

A comprehensive playbook detailing advanced techniques for bypassing modern Endpoint Detection and Response (EDR) and Antivirus (AV) solutions on Windows. Covers exploiting vulnerabilities in AMSI, ETW, and implementing sophisticated process injection methods (e.g., Process Hollowing, Early Bird) to execute payloads while maintaining stealth.

A comprehensive playbook detailing expert techniques for lateral movement across Windows networks. It covers various protocols and methods for pivoting between compromised hosts, including PsExec, WMI, WinRM, DCOM, SMB, RDP, and advanced credential techniques like Pass-the-Hash (PTH) and Pass-the-Ticket (PTT).

A comprehensive guide and toolkit for performing End-to-End (E2E) testing on native Windows desktop applications (WPF, WinForms, Win32, Qt) using pywinauto and the Windows UI Automation (UIA) API. Covers setup, locator strategies, and page object modeling for robust desktop automation.

A risk-paranoid, mandatory review process designed to interrogate any plan that touches sensitive customer data, regulatory compliance, or production access. It forces consideration of critical security pillars including STRIDE threat modeling, blast radius quantification, detection mechanisms (MTTD), incident response runbooks, regulatory notification windows, and third-party vendor security posture. Essential before deploying features handling PII, PHI, or before compliance audits (SOC 2, HIPAA, GDPR).

A powerful utility for programmatically controlling and monitoring interactive terminal sessions running within tmux. It allows users to send keystrokes, scrape full pane output history, navigate between panes/windows, and manage the lifecycle of long-running CLIs (like AI coding sessions). Essential for advanced scripting and reliable remote workflow automation, especially when dealing with stateful, interactive applications.

This skill guide provides comprehensive implementation details for the Metro/Modern UI style, mimicking the aesthetic of Windows Phone/8 start screens. It focuses on creating sharply cornered, flat-color tiles arranged in a horizontally scrolling grid. Key features include live data updates (e.g., tile flipping) and replicating the classic interactive 'tilt' effect. Applicable for cross-platform development using Web (CSS), iOS (SwiftUI), and Flutter.

A comprehensive guide for conducting memory forensics to extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps (LSASS). This technique is crucial during incident response or breach assessment to identify compromised accounts or investigate lateral movement.

This skill provides advanced detection methods for credential dumping, covering LSASS memory access, SAM hive extraction, and NTDS.dit theft (e.g., using Mimikatz). It utilizes Sysmon Event ID 10 and Windows Security logs to enable threat hunting, assisting SOC analysts in triaging EDR alerts and building robust SIEM correlation rules.

This skill details how to abuse the Windows DPAPI (Data Protection API) to extract and decrypt sensitive secrets protected by the OS. It covers multiple scenarios: online decryption (using the target user's context), offline decryption (requiring passwords or NTLM hashes), and advanced domain-wide decryption via the DPAPI backup key. Essential for red-teaming and post-exploitation activities to harvest credentials, browser logins, and Wi-Fi passwords.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.