Skill UI

Build a rogue Wi‑Fi access point that mimics or outcompetes a legitimate network to attract client devices. Useful for security assessments involving captive portals, client coercion, and traffic interception after association.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A wireless 802.11 offensive testing methodology for red team and security assessments. It covers monitor-mode setup, handshake and PMKID capture, WPA3/Enterprise attacks, evil twin setups, WPS abuse, and related wireless intrusion techniques.

Covers WPA3/SAE attack techniques including transition-mode downgrade, Dragonblood side-channel analysis, SAE authentication flooding, H2E checks, and Wi-Fi 6E implications. Useful for assessing wireless security gaps and validating defensive hardening.

Methodology for assessing WPS-enabled routers using Pixie Dust offline recovery, online PIN brute force, lockout handling, and PBC edge cases. Useful for wireless security testing and understanding WPS exposure on consumer APs.

A comprehensive playbook detailing advanced attack techniques against Active Directory Certificate Services (AD CS). It covers exploiting misconfigured templates (ESC1-ESC13), performing NTLM relay attacks, and achieving privilege escalation via CA officer abuse. This guide is essential for offensive security practitioners conducting penetration testing simulations.

A comprehensive methodology for exploiting Time-of-Check / Time-of-Use (TOCTOU) race conditions across diverse system layers. This covers symlink swaps, file-descriptor races, kernel double-fetch vulnerabilities, and advanced window-widening primitives like FUSE slow filesystems and userfaultfd. Essential for security researchers targeting race-based privilege escalation in binaries, kernels, and container orchestrators.

A comprehensive guide detailing attack methodologies for Z-Wave smart home networks. Techniques covered include sniffing during inclusion (S0/S2), exploiting key derivation flaws, performing replay attacks on unauthenticated nodes, and crucial hub compromise (pivoting) to gain full control over the entire mesh network. Essential reading for IoT penetration testing.

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

A powerful offensive security toolkit for red-teaming and penetration testing. It systematically enumerates and exploits various misconfigurations within Active Directory Certificate Services (AD CS) using Certipy. This allows attackers to forge privileged certificates, perform PKINIT authentication, and achieve domain compromise and privilege escalation, even without knowing user passwords. Ideal for validating security hardening.