Other skills

Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.

The English summary is being prepared. Showing the original description.

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

The English summary is being prepared. Showing the original description.

Lattice-based cryptanalysis playbook. Use when attacking RSA via Coppersmith small roots, recovering DSA/ECDSA nonces from bias, solving knapsack problems, or applying LLL/BKZ reduction to cryptographic constructions.

The English summary is being prepared. Showing the original description.

Exploit JSON Web Tokens (JWT) by implementing the 'None' algorithm attack. This skill details how to bypass authentication mechanisms when a server improperly accepts JWTs with the `alg` header set to `none`, allowing attackers to forge tokens without a valid signature.

The English summary is being prepared. Showing the original description.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.

The English summary is being prepared. Showing the original description.

Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.

The English summary is being prepared. Showing the original description.

PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.

The English summary is being prepared. Showing the original description.

Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

The English summary is being prepared. Showing the original description.

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

The English summary is being prepared. Showing the original description.

Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.

The English summary is being prepared. Showing the original description.

Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.

The English summary is being prepared. Showing the original description.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Understand the mechanics of Border Gateway Protocol (BGP) Hijacking, where an attacker creatively manipulates Internet routing tables to intercept, monitor, or drop massive volumes of network traffic destined for legitimate Autonomous Systems (AS).

The English summary is being prepared. Showing the original description.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

The English summary is being prepared. Showing the original description.

Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.

The English summary is being prepared. Showing the original description.

Inspects a skill's SKILL.md and its observations/runs.md log, identifies failure patterns, and proposes a targeted amendment to improve the skill. Trigger on: "improve this skill", "fix this skill", "update this skill", "why does X keep failing", "this skill is wrong", "add this to the skill", or automatically when observations/<skill-name>/runs.md contains 3 or more failure entries. Outputs the amendment as a diff the user can review before applying. Records the amendment rationale in observations/<skill-name>/runs.md after user confirmation.

The English summary is being prepared. Showing the original description.

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.

The English summary is being prepared. Showing the original description.

Advanced Lightning App Builder usage: component visibility filters, custom page templates, Dynamic Forms, Dynamic Actions, page performance optimization, LWC targetConfig constraints on record pages. Use when building complex record pages or custom app templates. NOT for Dynamic Forms basics — use admin/dynamic-forms-and-actions. NOT for exposing an LWC via js-meta.xml targets — use lwc/lwc-app-builder-config.

The English summary is being prepared. Showing the original description.

Use this skill to configure and manage Field Service Lightning workforce capacity — covering ServiceResourceCapacity for individual resource caps, WorkCapacityLimit for territory-level demand throttling, and reporting strategies for capacity vs. utilization analysis. NOT for resource skills, certifications, or preference setup — use admin/fsl-resource-management. NOT for work rules and service objectives — use admin/fsl-scheduling-policies. NOT for Omni-Channel agent capacity — use architect/omni-channel-capacity-model.

The English summary is being prepared. Showing the original description.

Flow Orchestration admin: stage configuration, step assignment, background steps, interactive steps, evaluation flows, work items, pause/resume. NOT for approval routing a standard approval process would handle — use admin/approval-processes.

The English summary is being prepared. Showing the original description.