Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.
Investigate insecure deserialization, where restoring objects from stored or transmitted data can execute unwanted code. Covers multiple languages, input format recognition, vulnerable processing points, verification methods, and documentation of affected libraries and entry points.
Test application business rules by mapping workflows and checking unexpected actions, inputs, identities, and repetition. The skill helps investigate checkout, refunds, subscriptions, permissions, and concurrency flaws, then document reproduction steps and financial impact.
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.
Plan and run fuzz testing, which feeds varied inputs to software to uncover bugs. The skill guides tool selection, test harness creation, input collection, coverage measurement, and crash triage for parsers, protocols, kernels, and other targets.
Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.
Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.
Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.
Organize red team exercises that simulate adversaries to assess an organization's detection and response. Covers engagement rules, infrastructure, operational controls, evidence handling, and reports that help security teams review gaps and prioritize improvements.
Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.
Assess GraphQL APIs during penetration tests, from finding endpoints and mapping data structures to checking access controls, query limits, subscriptions, and uploads. Includes example queries, guidance for testing tools, and defensive controls for interpreting findings.
Assess Wi-Fi disconnection and reconnection behavior using deauthentication and disassociation tests. The skill covers client targeting, handshake capture, protected management frames, transmission scope and rate, and reporting observed effects and detection signals.
Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.
Assess JWT authentication in web and mobile apps using a structured security checklist. Examine token signatures, key handling, validation, and storage to investigate authentication bypass risks and identify relevant fixes.
Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.
Assess Bluetooth Classic devices such as older car kits, industrial sensors, and audio accessories. The skill guides device discovery, service inspection, authentication checks, and known vulnerability assessment, helping document exposed functions and device-specific findings.
Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.
Is this your account? Link GitHub to bring it onto your creator page (Japanese)