Skill UI

Guides comprehensive API security testing for REST, GraphQL, and gRPC services using the OWASP API Security Top 10, combining Burp Suite, Postman, and custom scripts to validate authentication, authorization, rate limiting, input validation, and business logic defenses.

Guide for assessing AWS, Azure, and GCP environments with tools such as Pacu, ScoutSuite, and Prowler to uncover IAM weaknesses, exposed storage, insecure serverless functions, and cloud-native attack chains.

Guides administrators through configuring TLS 1.3 on nginx, Apache, and Python apps, validating cipher suites, enabling 0-RTT precautions, disabling legacy TLS, and testing with OpenSSL/testssl for hardened secure communications.

Guides penetration testers through discovering endpoints, validating authentication, checking for CSWSH, and probing message injection flaws in WebSocket implementations using Burp Suite, wscat/websocat, and custom Python scripts during authorized assessments.

Blueprint for implementing cloud security posture management across AWS, Azure, and GCP using native services plus Prowler and ScoutSuite scans, automated daily pipelines, and unified aggregation to surface misconfigurations and compliance drift.

Implements multi-cloud CSPM by wiring AWS Security Hub, Azure Defender for Cloud, and tools like Prowler and ScoutSuite to detect misconfigurations and posture risks.

Intercepts mobile app HTTP/HTTPS traffic through a Burp Suite proxy to analyze insecure APIs, authentication flaws, certificate pinning, data leakage, and server-side responses during mobile penetration tests or API security assessments.

Use ScoutSuite to enumerate AWS accounts, capture resource configurations, surface misconfigurations, and create interactive reports so audit, incident response, or compliance teams can prioritize remediation efforts.

Provides a workflow for authorized penetration testing across AWS, Azure, and GCP to discover IAM, storage, serverless, and compute weaknesses, leveraging Pacu, ScoutSuite, Prowler, and cloud-native tools.

Simulates CSRF attacks during authorized penetration tests to exercise state-changing endpoints, evaluate anti-CSRF tokens, SameSite cookies, and header checks, then craft PoCs via Burp Suite for remediation insight.

Guides security teams through Forseti, SCC, and gcloud workflows to audit IAM policies, firewall rules, bucket permissions, and CIS benchmark compliance across GCP organizations with optional ScoutSuite comparison and BigQuery exports for analysis.

This skill provides a comprehensive method for assessing SSL/TLS server configurations using the powerful Python library, sslyze. It evaluates crucial security aspects including supported protocol versions (e.g., TLS 1.2, 1.3), cipher suite strength, certificate chain validity, HSTS enforcement, and checks for common vulnerabilities like Heartbleed and ROBOT. Ideal for penetration testing, security auditing, and incident response.