Skill UI

Kerberoasting is a credential access attack (T1558.003) targeting Active Directory service accounts with Service Principal Names (SPNs). This skill demonstrates using Impacket to request Kerberos TGS tickets for these accounts. The resulting RC4 or AES-encrypted tickets are then cracked offline using tools like Hashcat or John the Ripper, allowing attackers to recover service account credentials for lateral movement during authorized penetration testing or red-team engagements.

This guide details the detection and exploitation of the critical MS17-010 (EternalBlue) vulnerability in SMBv1. It covers the full red-teaming lifecycle, including vulnerability scanning using Nmap and executing payloads via Metasploit. It is designed for authorized penetration testing and simulated adversary engagements against legacy Windows environments.

This guide details the exploitation chain for noPac, combining CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). It demonstrates how an attacker can escalate from a standard domain user to Domain Admin by manipulating Active Directory tickets and performing DCSync. Primarily used in authorized red-teaming and penetration testing to validate domain security.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.

A comprehensive guide for authorized penetration testing, demonstrating how to identify and exploit critical vulnerabilities in the SMB protocol (e.g., EternalBlue, PrintNightmare). This skill covers network enumeration, lateral movement techniques (Pass-the-Hash, SMB Relay), and post-exploitation activities using Metasploit and Impacket tools to assess enterprise network security posture.

This comprehensive guide details the professional process of detecting and exploiting SQL injection vulnerabilities using the powerful sqlmap tool. It covers the entire workflow, from initial vulnerability identification and basic scanning to database enumeration, data dumping, advanced exploitation (like file reading and OS command execution), and WAF bypass techniques, ensuring thorough penetration testing reporting.

This guide details the comprehensive methodology for detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across multiple popular template engines, including Jinja2, Twig, and Freemarker. It provides step-by-step workflows, covering payload detection using basic arithmetic expressions, engine identification, and executing advanced Remote Code Execution (RCE) payloads for penetration testing purposes.

This skill details techniques for exploiting PHP's type juggling vulnerabilities, primarily caused by loose (==) comparison operators. It demonstrates how attackers can bypass authentication mechanisms, defeat magic hash function verifications, and manipulate application logic through controlled type coercion when testing web applications. Ideal for authorized security penetration testing.

A comprehensive guide to using the Metasploit Framework for advanced penetration testing and vulnerability validation. This skill details how to confirm exploitability of identified CVEs, gather post-exploitation evidence, and validate patch remediation effectiveness. It is essential for risk-based vulnerability management and red team exercises, providing proof of real-world impact beyond simple scanner scores.

This comprehensive guide outlines techniques for authorized penetration testing of real-time web applications using WebSocket connections. It covers discovering various WebSocket endpoints, testing for authentication bypass, identifying Cross-Site WebSocket Hijacking (CSWSH) vulnerabilities, and assessing message handling for injection flaws (SQLi, XSS). Essential for securing chat, trading, and live notification platforms.

This skill guides the deployment and implementation of Breach and Attack Simulation (BAS) platforms. It provides a continuous, automated method to validate security control effectiveness against real-world attacker techniques mapped to the MITRE ATT&CK framework. Use this when moving beyond traditional point-in-time penetration testing to establish continuous control validation and automated adversary emulation across the entire IT environment.

A comprehensive guide for intercepting and analyzing HTTP/HTTPS traffic from mobile applications using Burp Suite. This skill walks through configuring proxies on Android and iOS, handling CA certificate installation, and executing advanced penetration testing techniques. It is essential for assessing API security, identifying data leakage, and finding authentication vulnerabilities in mobile client-server communications.