Test design, vulnerability assessment, and quality assurance (13.1K skills)
Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
Trace how requests travel through a CTF sandbox, from hostnames and proxy rules to containers and processes. Compare headers and live traffic to identify which service handles a request and what changes its destination.
Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.
Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.
Investigate AI-agent and cloud infrastructure challenges in a CTF sandbox. Trace untrusted content into tool actions, compare deployment configuration with runtime behavior, and follow software artifacts from source through build and release to their actual consumers.
Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.
Review suspicious emails for phishing and business email fraud by examining sender authentication, message content, links, and attachments. Organize indicators of compromise, which are traces of malicious activity, and recommend controls for the email environment.
Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.
Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.
Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.
Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.
Assess industrial control systems by mapping devices, network zones, and exposed protocols. The workflow prioritizes observing traffic and read-only checks, then organizes evidence about configuration weaknesses, firmware vulnerabilities, and potential effects on physical processes.
Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.
Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.
Analyze how EDR, software that monitors endpoint threats, and antivirus products detect activity. Support authorized exercises by examining monitoring mechanisms, assessing evasion approaches, and checking detection results in an isolated test environment.
Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.
Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.
Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.
Analyze Android apps in a CTF sandbox using static inspection and Frida hooks, which observe or alter running code. Trace request signing, local storage, and Java-to-native boundaries to reproduce a request accepted by the server.
Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.
Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.
Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.
Review an existing security case package before report handoff. Check links between evidence, findings, investigation paths, tasks, and timeline entries, optionally verify file hashes to detect changes, and produce a Markdown or JSON review.