Skill UI

Utilizes structured critical reasoning to rigorously stress-test ideas, plans, and decisions. This skill allows you to play devil's advocate, conduct pre-mortems, execute red-teaming exercises, or audit underlying assumptions. It employs multiple advanced modes, including Socratic questioning, Hegelian dialectics, and Falsificationism, to identify blind spots, weaknesses, and unstated assumptions before commitment.

This skill details the advanced technique of DCSync, which exploits the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller. It is primarily used in authorized red-teaming and penetration testing to dump sensitive credentials, extract the KRBTGT hash, and ultimately forge Golden Tickets, establishing deep domain persistence. Ideal for security auditors and offensive security professionals.

Pass-the-Ticket (PtT) is a critical post-exploitation technique used in red teaming and offensive security assessments. It allows an attacker to move laterally across a network by utilizing stolen Kerberos tickets (TGT or TGS) without ever needing the user's password. This skill outlines the process of dumping tickets from memory (e.g., LSASS) and injecting them into a current session to impersonate a high-privilege user for access to sensitive resources.

This guide outlines the comprehensive process for planning and executing authorized vishing (voice phishing) pretext calls. Used in red teaming exercises, it assesses employee susceptibility to social engineering attacks and evaluates the effectiveness of existing security awareness controls. Key steps include OSINT research, developing believable pretexts (e.g., IT helpdesk impersonation), structured call execution, and collecting detailed metrics.

This technique details how to exploit misconfigurations within Kerberos Constrained Delegation (KCD) in Active Directory. By leveraging S4U2self and S4U2proxy extensions, attackers can impersonate highly privileged users (e.g., Domain Admins) to request service tickets, enabling lateral movement and full domain compromise during authorized red teaming or penetration testing.

Detailed guide on exploiting the critical MS17-010 (EternalBlue) vulnerability in SMBv1 protocol. This technique allows for remote code execution (RCE) on unpatched Windows systems. Primarily used in authorized red teaming, penetration testing, and advanced security analysis to simulate real-world attacks and assess network defense posture.

This skill details the exploitation of the critical Zerologon vulnerability (CVE-2020-1472) found in the Microsoft Netlogon Remote Protocol. It allows an unauthenticated attacker to compromise a domain controller by resetting its machine account password. The guide covers the complete attack chain, including initial exploitation, credential dumping via DCSync, and subsequent privilege escalation in Active Directory environments. Used exclusively for authorized red teaming and security testing.

This guide provides a structured methodology for proactively hunting adversaries who establish persistence using Windows Scheduled Tasks (T1053). It outlines the necessary prerequisites (EDR, SIEM, Sysmon) and a comprehensive workflow—from hypothesis formulation to threat correlation—for detecting suspicious task creation, unusual scheduling patterns, and attacker TTPs during incident response or red teaming.

This skill guides Security Operations Center (SOC) teams through structured threat modeling using the MITRE ATT&CK framework. It enables mapping adversary Tactics, Techniques, and Procedures (TTPs) against organizational assets to identify critical detection coverage gaps, prioritize defensive investments, and improve overall security posture. Ideal for risk assessment, purple teaming, and compliance planning.

BloodHound is an open-source reconnaissance tool that leverages graph theory to analyze Active Directory relationships. This guide details the process of collecting AD data using SharpHound and visualizing complex attack paths. It helps identify potential privilege escalation chains, trust abuses, and misconfigurations necessary for an attacker to move from a low-privilege user account to Domain Admin, making it essential for advanced red-teaming and security auditing.

This skill systematically enumerates and audits Active Directory forest trust relationships using advanced techniques like SID filtering analysis, detecting SID history abuse, and assessing inter-realm Kerberos ticket configurations. It is designed for red-teaming and security auditing to identify potential lateral movement paths and trust vulnerabilities across organizational boundaries.

LaZagne is an open-source post-exploitation tool utilized by red teams to harvest stored credentials from compromised endpoints. It supports Windows, Linux, and macOS, extracting passwords from browsers (Chrome, Edge), databases (MySQL, SQLite), system vaults (DPAPI, LSA), and various applications. It is crucial for privilege escalation and lateral movement during authorized security assessments.