Skill UI

A comprehensive guide for conducting authorized vishing (voice phishing) pretext calls. This technique, utilized in red-teaming, simulates an attacker impersonating a trusted authority (e.g., IT support, vendor) to test an organization's human security controls. It measures employee adherence to verification protocols and highlights vulnerabilities in staff security awareness.

A comprehensive tool designed to discover and map adversary-controlled assets, including C2 servers, phishing domains, and exploit kits. It utilizes sophisticated pivoting techniques across passive DNS records, Certificate Transparency logs, Shodan/Censys scans, and network fingerprints (JARM/JA3S) to generate actionable threat intelligence, perfect for CTI investigations and security operations.

A sophisticated red-teaming tool for authorized security testing, simulating OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID. It demonstrates how attackers can bypass MFA and steal access and refresh tokens by tricking victims into authorizing access via the genuine Microsoft login page. Essential for validating Conditional Access and token protection controls.

A comprehensive guide for threat hunters focusing on detecting stolen session cookies and OAuth/PRT token replay (T1550.001). This skill teaches correlation techniques across Microsoft Entra ID SigninLogs and Okta System Logs, enabling the detection of impossible travel, refresh-token reuse, and anomalous lateral movement within federated SaaS environments. Essential for post-phishing or post-compromise investigations.

This guide provides a systematic framework for authorized email security reviews. It covers advanced phishing analysis, including deep dives into email headers, assessing SPF/DKIM/DMARC compliance, identifying Business Email Compromise (BEC) patterns, and researching mailbox token abuse. It is essential for incident response, threat intelligence, and security architecture review.

Analyzes published DNS TXT records (SPF, DMARC, DKIM, BIMI) to produce a priority-ordered spoofability verdict for a domain. Distinguishes envelope MAIL FROM from header From, handles SPF PermError and include-chain takeover risks, and explains why SPF -all alone is insufficient without DMARC enforcement. Use for security audits and phishing feasibility assessments.

A comprehensive guide for authorized red team engagements, covering the end-to-end lifecycle of advanced phishing campaigns. Learn techniques for infrastructure setup (domain aging, SPF/DKIM/DMARC), payload delivery (macro weapons, HTML smuggling), and bypassing email security gateways (MFA bypass, domain spoofing). Essential knowledge for penetration testers and security professionals.