Skill UI

This guide outlines a comprehensive methodology for hardening AWS Lambda execution roles. It focuses on implementing the principle of least privilege by auditing existing roles, analyzing actual API usage via CloudTrail and IAM Access Analyzer, and programmatically creating scoped IAM policies. Use this when deploying new serverless functions, remediating over-privileged roles found during security audits, or building secure, reusable role templates.

A comprehensive guide to securing serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions). It covers critical security aspects including enforcing least-privilege IAM roles, integrating secrets management, vulnerability scanning of dependencies, input validation, and implementing runtime monitoring for robust DevSecOps practices.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

A comprehensive skill guide for assessing JSON Web Token (JWT) security flaws. This technique covers advanced attack vectors such as algorithm confusion (e.g., RS256 to HS256), 'none' algorithm bypass, key ID (kid) injection, and JKU/X5U parameter manipulation. It also includes methods for brute-forcing weak symmetric secrets and is essential for penetration testing OAuth2/OIDC and SSO systems.

A comprehensive guide and set of payloads for penetration testing web applications that process XML input. It details how to test for major vulnerabilities such as XXE, XPath injection, SSRF, and XML parsing attacks, providing step-by-step workflows and advanced payloads for identifying data exposure and security flaws.

A comprehensive security tool designed to assess the resilience of OAuth 2.0 and OpenID Connect (OIDC) implementations. It probes for critical misconfigurations and security flaws, including authorization code interception, redirect URI manipulation (open redirects), CSRF vulnerabilities, scope escalation, token leakage, and PKCE bypass. Essential for penetration testing of Single Sign-On (SSO) systems and API security.

A comprehensive guide and code suite for performing penetration testing on real-time WebSocket APIs (WS/WSS). This tool assesses vulnerabilities including Cross-Site WebSocket Hijacking (CSWSH), missing handshake authentication, message injection, input validation failures, and DoS risks. It guides users through analyzing the handshake process and testing authorization enforcement using Python and specialized tools.

A comprehensive guide for implementing hardware-level confidential computing using AWS Nitro Enclaves. This process involves creating secure enclave images (EIFs), performing cryptographic attestation validation against the Nitro PKI, and configuring AWS KMS policies. It ensures that sensitive data (like PII or PHI) remains isolated from the parent EC2 instance, guaranteeing security even if the host system is compromised.

This skill provides a comprehensive guide and structured SQL templates for performing deep forensic investigations on AWS cloud logs. It utilizes AWS Athena to query massive datasets from CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs. Ideal for detecting unauthorized access, data exfiltration, and privilege escalation during security incident response.

This skill automates the entire SOC 2 Type II audit lifecycle. It facilitates gap assessment against AICPA Trust Services Criteria (CC1-CC9) and collects continuous evidence from major cloud providers (AWS, Azure, GCP) and identity systems (Okta, Jira). It supports validating control effectiveness, remediation tracking, and overall compliance monitoring for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Checks AWS, Azure, and GCP configurations for IAM escalation paths, public storage exposure, open security groups, and IaC gaps, providing preventive findings with MITRE mapping for cloud posture management workflows.

AWS Detective automatically analyzes log data from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to build interactive behavior graphs. This tool enables security analysts to investigate suspicious activity, trace lateral movement across accounts, profile compromised entities (IAM users, EC2 instances), and reconstruct complex attack timelines without manual log parsing. Ideal for triaging GuardDuty findings or investigating suspected AWS compromises.