Skill UI

Methodology for assessing WPS-enabled routers using Pixie Dust offline recovery, online PIN brute force, lockout handling, and PBC edge cases. Useful for wireless security testing and understanding WPS exposure on consumer APs.

A comprehensive playbook detailing advanced attack techniques against Active Directory Certificate Services (AD CS). It covers exploiting misconfigured templates (ESC1-ESC13), performing NTLM relay attacks, and achieving privilege escalation via CA officer abuse. This guide is essential for offensive security practitioners conducting penetration testing simulations.

A comprehensive methodology for exploiting Time-of-Check / Time-of-Use (TOCTOU) race conditions across diverse system layers. This covers symlink swaps, file-descriptor races, kernel double-fetch vulnerabilities, and advanced window-widening primitives like FUSE slow filesystems and userfaultfd. Essential for security researchers targeting race-based privilege escalation in binaries, kernels, and container orchestrators.

A comprehensive guide detailing attack methodologies for Z-Wave smart home networks. Techniques covered include sniffing during inclusion (S0/S2), exploiting key derivation flaws, performing replay attacks on unauthenticated nodes, and crucial hub compromise (pivoting) to gain full control over the entire mesh network. Essential reading for IoT penetration testing.

Stratus Red Team is an open-source tool for detection engineering and purple teaming. It atomistically detonates granular, MITRE ATT&CK-mapped offensive techniques across AWS, Azure, GCP, and Kubernetes. The tool executes a full, repeatable lifecycle (warmup, detonate, revert, cleanup) to generate realistic attacker telemetry. Use it to validate if cloud security tools (like CloudTrail or Sentinel) reliably trigger on simulated attacks, or to safely practice red teaming.

A comprehensive guide for red team operators detailing techniques to manipulate, clear, or destroy digital evidence on Windows and Linux systems. Covers clearing Windows Event Logs (wevtutil), manipulating Linux system logs, timestamp forgery, file system scrubbing, and memory artifact removal. Essential for understanding advanced evasion methods and achieving operational security during authorized engagements.

Covers advanced API exploitation methodologies, focusing on business logic abuse, API call chaining, and sophisticated attack patterns that bypass traditional security controls. Topics include GraphQL abuse (batching, introspection), JWT manipulation (algorithm confusion), race conditions, and identifying API key leakage. This guide is designed for authorized penetration testers targeting deep-seated, logic-layer vulnerabilities.

A comprehensive guide to conducting authorized security assessments across API-driven applications. This skill covers REST, gRPC, and WebSocket protocols, addressing the full OWASP API Security Top 10 2023. Techniques include identifying Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and implementing fuzzing for various API endpoints. Designed for professional penetration testing engagements.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

A comprehensive guide detailing systematic techniques for breaking out of container isolation (Docker, Podman, containerd) into the underlying host operating system. Covers exploiting misconfigurations, abusing privileged modes, manipulating Linux capabilities (CAP_SYS_ADMIN), utilizing namespaces (nsenter), and exploiting known container runtimes CVEs. Essential for penetration testing and security red teaming engagements.

A systematic methodology for performing offensive cryptographic analysis. This skill focuses on identifying and exploiting flaws arising from the misuse of cryptographic primitives in real-world applications, rather than breaking the underlying math. Techniques covered include Padding Oracle Attacks (CBC), ECB block manipulation, Hash Length Extension, RSA weaknesses, and PRNG exploitation. Ideal for penetration testing and deep security auditing.

A comprehensive guide covering the full attack lifecycle in Kubernetes. Techniques include service account token theft, RBAC misconfiguration exploitation, kubelet API abuse, pod escape, and cloud metadata compromise across major cloud platforms (AWS, GCP, Azure). Essential for security assessment and penetration testing of cloud-native environments.