Skill UI

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.

This guide details advanced hash cracking techniques using Hashcat, the world's fastest password recovery tool. It covers various attack modes—including dictionary, brute-force, and rule-based attacks—and supports numerous common hash types (e.g., NTLM, bcrypt). This skill is strictly designed for authorized security assessments and penetration testing to evaluate the strength and resilience of organizational password policies.

A comprehensive guide detailing the Kerberoasting attack process, a critical post-exploitation technique in Active Directory environments. This method targets service accounts by requesting TGS tickets for accounts with Service Principal Names (SPNs), allowing attackers to capture encrypted tickets for offline password cracking. Essential for security assessments and red team simulations.

This comprehensive guide details the process of capturing WPA/WPA2 handshakes and performing offline dictionary and brute-force password cracking. It utilizes industry-standard tools like aircrack-ng and hashcat to assess the strength of wireless network security during authorized penetration tests. It covers everything from interface preparation to final report generation.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

This skill guides comprehensive security testing for Host Header Injection vulnerabilities in web applications. It simulates attacks to identify critical risks such as password reset poisoning, web cache poisoning, Server-Side Request Forgery (SSRF), and virtual host routing manipulation. It is essential for penetration testers assessing backend security behind proxies and load balancers.

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

A comprehensive guide for implementing phishing-resistant multi-factor authentication using FIDO2/WebAuthn protocols. Learn to build a complete relying party server using Python, supporting both roaming hardware keys (e.g., YubiKey) and platform biometrics. Covers registration ceremonies, credential storage, and migrating to passwordless authentication.

This comprehensive skill guide details how to correctly integrate and manage Firebase Authentication within Flutter applications. It covers initial setup, real-time state observation using streams, and implementing various sign-in methods, including email/password, phone, and major social providers (Google, Apple). It also emphasizes secure coding practices, error handling, and state management best practices.

Provides quick reference to penetration testing commands for network scanning, exploitation, password cracking, and web testing workflows, helping security professionals run tools like Nmap, Metasploit, Nikto, and SQLMap during assessments.

This comprehensive skill guides users through installing and configuring the necessary SDKs (jsforce, simple-salesforce) to connect programmatically to Salesforce. It thoroughly covers multiple industry-standard OAuth 2.0 flows, including Username-Password, JWT Bearer, and Web Server flow. This is essential for setting up secure, robust integrations in new projects, CI/CD pipelines, or user-facing applications requiring access to Salesforce data.

This guide provides comprehensive steps to install and configure Snowflake SDKs for Node.js and Python. It covers various authentication methods, including password, secure Key Pair authentication (ideal for CI/CD), and enterprise-grade SSO/OAuth integration. Use this when setting up data pipelines or applications that require reliable and secure connectivity to the Snowflake data warehouse.