SnailSploit | Kai Aizen

Assess Kubernetes security from an existing pod or API access point. Covers permission checks, exposed node services, secrets, host access, and cloud metadata to explain how configuration weaknesses can expand access across a cluster.

• Review service account permissions and RBAC settings
• Assess host access and secrets exposure from pods
• Trace access paths from a cluster to cloud infrastructure

Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.

• Assessing client connections to rogue Wi-Fi
• Planning captive portal security exercises
• Reviewing conditions for traffic interception

Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.

• Assessing encrypted cookies and tokens
• Checking RSA keys and cryptographic settings
• Testing session token predictability

Map wireless networks before a security assessment. Choose compatible adapters, configure packet capture, identify access points and clients, and record channels, encryption, and management frame protection across 2.4, 5, and 6 GHz bands.

• Building a target inventory before a wireless assessment
• Choosing an adapter for the required frequency bands
• Recording encryption and management frame protection

Assess WPA/WPA2 Personal Wi-Fi password strength through authentication data capture, file conversion, and offline password testing. Covers dictionary searches, pattern-based guesses, vendor default passwords, and capture quality checks.

• Assessing Wi-Fi password strength
• Checking captured authentication data
• Reviewing vendor default password patterns

Turn penetration test and red team results into reports for executives and technical teams. Structure findings, explain severity scores and business impact, organize evidence, and document remediation steps and retest plans.

• Preparing a final penetration test report
• Rewriting an executive summary for nontechnical readers
• Creating a reusable security reporting template

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Test application business rules by mapping workflows and checking unexpected actions, inputs, identities, and repetition. The skill helps investigate checkout, refunds, subscriptions, permissions, and concurrency flaws, then document reproduction steps and financial impact.

• Checking checkout and refund workflows
• Testing price, quantity, and coupon rules
• Reviewing role and tenant boundaries

Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.

• Planning authorized phone and SMS security tests
• Reviewing visitor and badge verification procedures
• Designing USB device security exercises

Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.

• Compare C2 frameworks for a red team exercise
• Plan communication methods and relay infrastructure
• Review C2 detection signals from a defender's perspective

Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.

• Mapping an organization's publicly exposed infrastructure
• Connecting public company records and social profiles
• Investigating image locations and video evidence

Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.

• Map GraphQL endpoints and data structures
• Check access controls across users and roles
• Review query limits and subscription security

Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.

• Assessing JWT authentication in a web app
• Checking signature and key validation
• Reviewing token storage in mobile apps

Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.

• Assessing Linux privilege escalation paths
• Practicing privilege escalation in CTF challenges
• Reviewing sudo and scheduled task configurations

Assess Bluetooth Classic devices such as older car kits, industrial sensors, and audio accessories. The skill guides device discovery, service inspection, authentication checks, and known vulnerability assessment, helping document exposed functions and device-specific findings.

• Assessing older in-car Bluetooth devices
• Checking authentication on industrial device services
• Reviewing exposure to BlueBorne and KNOB

Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.

• Planning an authorized phishing exercise
• Preparing sending infrastructure and landing pages
• Reviewing email, QR code, and callback scenarios

Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.

• Assessing BLE authentication in smart locks
• Checking data access on fitness trackers
• Reviewing pairing security

Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.

• Planning persistence tests for authorized exercises
• Comparing methods by operating system and privilege
• Reviewing detection indicators for persistence

Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.

• Check access controls across users and roles
• Review token lifecycles and request limits
• Assess gRPC and WebSocket security

Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.

• Reviewing Z-Wave smart home device security
• Mapping S0 and S2 security modes across devices
• Planning traffic capture during device pairing

Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.

• Planning authorized evidence manipulation tests
• Reviewing Windows and Linux forensic artifacts
• Checking detection coverage for altered evidence

Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.

• Reviewing order and payment workflow integrity
• Testing concurrent coupon redemption or transfers
• Assessing JWT validation and GraphQL controls

Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.

• Identify authentication methods on enterprise Wi-Fi
• Review client validation of authentication server certificates
• Assess EAP-TLS certificate storage and issuance

Assess WPA3 wireless security by reviewing mixed WPA2/WPA3 settings and SAE, its password authentication method. Examine implementation weaknesses, H2E support, and 6 GHz requirements to determine relevant tests and detection signals.

• Reviewing security settings on WPA3 wireless networks
• Assessing downgrade risks in mixed WPA2/WPA3 deployments
• Organizing SAE implementation and H2E checks