Skill UI

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This skill teaches authorized users how to perform comprehensive password hash cracking using Hashcat. It covers various attack methodologies, including dictionary, brute-force, and rule-based attacks, and identification of common hash types (e.g., MD5, NTLM, bcrypt). The primary use case is for conducting controlled security assessments and penetration testing to evaluate password strength and compliance with current security policies. Always used under explicit authorization.

This comprehensive guide details the process of capturing WPA/WPA2 handshakes and performing offline dictionary and brute-force password cracking. It utilizes industry-standard tools like aircrack-ng and hashcat to assess the strength of wireless network security during authorized penetration tests. It covers everything from interface preparation to final report generation.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

This comprehensive guide provides a detailed methodology for performing security testing on web applications that handle email sending (e.g., contact forms, password resets, newsletters). It focuses on identifying CRLF/SMTP header injection vulnerabilities, guiding users on how to check if attackers can manipulate email headers, inject custom content, or abuse forms for spam relay during a penetration test.

This skill guides comprehensive security testing for Host Header Injection vulnerabilities in web applications. It simulates attacks to identify critical risks such as password reset poisoning, web cache poisoning, Server-Side Request Forgery (SSRF), and virtual host routing manipulation. It is essential for penetration testers assessing backend security behind proxies and load balancers.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

A comprehensive guide for building a FIDO2/WebAuthn relying party server using python-fido2. This skill covers the entire lifecycle of passwordless authentication, including secure credential registration (enrollment of hardware keys like YubiKey and resident passkeys) and robust authentication ceremonies. It is essential for migrating traditional password-based systems to phishing-resistant Multi-Factor Authentication (MFA).

Comprehensive guide for implementing Firebase Authentication in Flutter apps. Covers setup, auth state management, email/password sign-in, social login, error handling, and security best practices for production-ready auth flows.

Provides quick reference to penetration testing commands for network scanning, exploitation, password cracking, and web testing workflows, helping security professionals run tools like Nmap, Metasploit, Nikto, and SQLMap during assessments.

This comprehensive skill guides users through installing and configuring the necessary SDKs (jsforce, simple-salesforce) to connect programmatically to Salesforce. It thoroughly covers multiple industry-standard OAuth 2.0 flows, including Username-Password, JWT Bearer, and Web Server flow. This is essential for setting up secure, robust integrations in new projects, CI/CD pipelines, or user-facing applications requiring access to Salesforce data.

This guide provides comprehensive steps to install and configure Snowflake SDKs for Node.js and Python. It covers various authentication methods, including password, secure Key Pair authentication (ideal for CI/CD), and enterprise-grade SSO/OAuth integration. Use this when setting up data pipelines or applications that require reliable and secure connectivity to the Snowflake data warehouse.