Skill UI

This advanced skill explores offensive reconnaissance techniques focused on defeating modern operating system security boundaries and mitigations. Topics include kernel/user boundary manipulation, sandbox escapes (AppContainer, LPAC), COM/RPC boundary exploitation, hypervisor interactions, and various integrity level bypassing methods. It is essential for planning advanced privilege escalation paths and understanding deep Windows security architecture, including AMSI, WDAC, and ETW manipulation.

Methodology for red team testing of on-prem Active Directory, hybrid AD/Entra ID, and ADCS. Covers reconnaissance, credential abuse, privilege escalation, lateral movement, persistence, trust abuse, and Defender for Identity evasion.

Offensive cloud security methodology for AWS, Azure, and GCP. Covers identity discovery, credential harvesting, enumeration, privilege escalation, persistence, data exfiltration, lateral movement, serverless abuse, Kubernetes paths, and detection evasion during authorized assessments.

A comprehensive playbook detailing advanced techniques for exploiting misconfigured Active Directory Access Control Lists (ACLs). It covers BloodHound enumeration, abusing dangerous ACE types (GenericAll, WriteDACL), conducting DCSync attacks, leveraging shadow credentials, and exploiting GPO/LAPS weaknesses for privilege escalation and lateral movement in a deep dive for security professionals.

A comprehensive playbook detailing advanced attack techniques against Active Directory Certificate Services (AD CS). It covers exploiting misconfigured templates (ESC1-ESC13), performing NTLM relay attacks, and achieving privilege escalation via CA officer abuse. This guide is essential for offensive security practitioners conducting penetration testing simulations.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

A comprehensive playbook detailing advanced techniques for exploiting insecure deserialization flaws across Java, PHP, and Python. It covers traffic fingerprinting, identifying specific gadget chains (e.g., Commons Collections, Shiro), and utilizing tools like ysoserial to achieve Remote Code Execution (RCE) and privilege escalation.

A comprehensive playbook for advanced API security testing targeting GraphQL and REST APIs. It guides users through schema introspection, discovering hidden or undocumented fields, analyzing batching capabilities, and identifying authorization gaps (like IDORs). Essential for deep reconnaissance and identifying privilege escalation vectors.

An expert playbook for systematically testing Insecure Direct Object References (IDOR) and Broken Object/Function Level Authorization (BOLA/BFLA). This guide covers finding object identifiers across all request vectors (URL, body, headers, cookies), implementing A-B testing methodologies, identifying various ID patterns, and executing horizontal or vertical privilege escalation attacks. Essential for deep API security auditing.

An expert playbook detailing advanced techniques for Linux kernel exploitation. Covers vulnerability classes (UAF, OOB, Race Condition), building primitives, bypassing modern mitigations (KASLR, SMEP, SMAP, KPTI), and achieving root privilege escalation via functions like commit_creds or modprobe_path overwrite. Essential for CTF and advanced security research.

A comprehensive playbook detailing advanced techniques for attacking Kubernetes clusters. Covers API server access, RBAC privilege escalation, service account token abuse, etcd secrets extraction, Kubelet exploitation, and various container escapes. This guide is essential for security professionals and red teams performing deep security assessments on cloud-native infrastructure.

A comprehensive playbook detailing advanced techniques for bypassing core macOS security features, including TCC, Gatekeeper, SIP, and sandbox restrictions. This guide is essential for authorized red team operations and penetration testing targeting macOS endpoints, covering methods like direct database manipulation, extended attribute removal, and privilege escalation paths.