Skill UI

Kerberoasting is a post-exploitation technique used in Active Directory environments. It targets service accounts by requesting encrypted Kerberos TGS tickets for accounts with Service Principal Names (SPNs). These tickets are then cracked offline using tools like hashcat to recover the service account's NTLM credentials. This skill is intended only for authorized red team engagements and penetration testing to assess AD privilege escalation risks.

A comprehensive guide to systematically evaluating Kubernetes cluster security by simulating advanced attacker techniques. It covers attacking the API server, kubelet, etcd, RBAC, and secrets using specialized tools like kube-hunter, Kubescape, and peirates. Essential for authorized security assessments and hands-on validation of cluster defenses.

A comprehensive solution for performing Operational Technology (OT) vulnerability assessments using the Claroty xDome platform. It automatically discovers assets, correlates vulnerabilities using CVE and ICS-CERT advisories, and calculates risk scores. This method is designed for compliance requirements (e.g., IEC 62443, NERC CIP) and initial asset risk profiling, relying on passive monitoring and safe querying rather than active scanning or penetration testing.

This skill automates red team operations using the Covenant C2 framework, providing comprehensive capabilities for authorized adversary simulation. It covers the full attack lifecycle, including listener setup, deploying agents (grunts), executing tasks on compromised hosts, and tracking lateral movement via the Covenant API. Ideal for professional penetration testing and security auditing.

This tool performs comprehensive security testing on SOAP web services. It analyzes WSDL definitions to identify available methods and then tests for critical XML-related vulnerabilities, including XXE, XPath injection, XML bombs, and WS-Security bypass. It is designed for automated penetration testing of enterprise-level SOAP APIs.

Simulates man-in-the-middle (MITM) attacks by stripping SSL/TLS encryption, forcing HTTPS connections to downgrade to insecure HTTP. This skill is designed for authorized penetration testing to validate HSTS enforcement, assess certificate validation mechanisms, and train security teams on detecting cleartext data leakage during a downgrade attack.

This tool automates the testing of web application URL parameters for Server-Side Request Forgery (SSRF). It probes sensitive endpoints, including cloud metadata services (AWS, GCP, Azure), internal network resources, and various URI schemes (file://, gopher://). It is designed for authorized penetration testing environments to confirm SSRF vulnerabilities and generate detailed threat reports.

This comprehensive guide details how to perform thorough and passive subdomain enumeration using Subfinder. It is an essential process during the reconnaissance phase of penetration testing, bug bounty hunting, and security assessments. By integrating multiple passive sources (like Shodan, Censys, and Certificate Transparency logs), users can efficiently map the entire attack surface of a target organization, discover forgotten or misconfigured assets, and prepare for subsequent vulnerability scanning.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

This framework executes sophisticated threat emulation tests using Atomic Red Team, mapping directly to MITRE ATT&CK techniques. It allows security teams to actively simulate adversary behavior, validating the detection coverage of SIEM rules and EDR controls. Use this tool for comprehensive purple team operations, penetration testing, and security auditing.

This skill simulates advanced Layer 2 network attacks, including VLAN hopping, using techniques like switch spoofing (DTP) and 802.1Q double tagging. It is designed exclusively for authorized penetration testing environments to validate network segmentation, test trunk port hardening, and assess the risk of unauthorized VLAN access across the network infrastructure.

This comprehensive guide details the process of performing authenticated and unauthenticated vulnerability assessments using Tenable Nessus. It covers everything from advanced scan configuration (port discovery, credentialing, plugin setup) to detailed result analysis, including cross-referencing CVEs and prioritizing remediation based on CVSS scores and exploit availability. Ideal for compliance auditing, penetration testing, and maintaining system patch compliance.