Skill UI

This skill implements a sophisticated risk-based prioritization engine by combining three critical data sources: the CISA Known Exploited Vulnerabilities (KEV) catalog, the Exploit Prediction Scoring System (EPSS), and traditional CVSS scores. It allows security teams to move beyond simple severity ratings, focusing remediation efforts on vulnerabilities confirmed to be actively exploited in the wild or predicted to be highly exploitable. The workflow integrates fetching, enriching, and scoring vulnerabilities to generate an actionable remediation plan with defined SLAs.

This skill provides a comprehensive guide to systematic dark web monitoring, involving scanning underground forums, paste sites, and marketplaces for organizational threats. It covers setting up Tor-based crawling, automating credential leak detection (e.g., HIBP integration), and analyzing threat intelligence (CTI) using Python. Essential for proactive incident response and security auditing.

A comprehensive guide to deploying deception technologies, including honeypots, honeytokens, and decoy systems, within a Security Operations Center (SOC). This skill is used to detect advanced attackers who bypass perimeter defenses by monitoring lateral movement, credential abuse, and internal reconnaissance. It provides high-fidelity, near-zero false positive alerts and is essential for threat hunting and incident response strategy.

This guide provides a comprehensive methodology for performing directory traversal and path traversal testing on web applications. It covers identifying file path parameters, executing basic payloads (Linux/Windows), bypassing common security filters using encoding (URL, double, UTF-8), and automating the process with tools like ffuf and dotdotpwn. It also details advanced steps for local file inclusion (LFI) and potential escalation to Remote Code Execution (RCE) via log poisoning.

A detailed guide for conducting professional disk forensics investigations, covering the entire lifecycle from evidence acquisition to artifact analysis. This includes establishing a strict chain of custody, performing bit-for-bit forensic imaging using write blockers, identifying file system structures (MFT, inodes), recovering deleted files, analyzing key artifacts (Prefetch, Amcache), and reconstructing precise timelines of activity for incident response cases.

A comprehensive guide for authorized penetration testing to map a target's entire DNS infrastructure. This skill covers advanced techniques including enumerating various DNS record types (A, MX, TXT, SRV), attempting zone transfers (AXFR/IXFR), brute-forcing subdomains, and analyzing security configurations (DNSSEC, SPF, DMARC). It is crucial for identifying the full external attack surface of a target organization.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.

An open-source tool based on the CIS Docker Benchmark. It systematically audits critical security aspects of Docker deployments, including host configuration, daemon settings, and container runtime. It generates a detailed compliance report (pass/fail/warn) to ensure best practices and security compliance in production environments.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This skill guides the systematic process of mitigating endpoint vulnerabilities. It involves calculating a comprehensive risk score by combining CVSS, EPSS, and CISA KEV data to prioritize findings. The workflow covers deployment of patches via platforms like WSUS/SCCM/Intune, applying necessary configuration changes, handling zero-day workarounds, and validating the fix to ensure endpoint compliance and system security.

A comprehensive guide detailing the process of performing entitlement reviews and access certification campaigns using SailPoint IdentityIQ. This skill is critical for maintaining compliance (SOX, HIPAA) by automating manager reviews, targeted privileged access validation, and identifying Separation of Duties (SOD) violations. It ensures robust access governance and facilitates automated remediation workflows.

A comprehensive guide simulating real-world attacks against internet-facing infrastructure (firewalls, web servers, DNS, etc.). It covers the entire penetration testing lifecycle, including passive and active reconnaissance, vulnerability scanning (using tools like Nmap, Nessus, and Nuclei), manual validation, and simulated exploitation, adhering to standards like PTES and OSSTMM.