Browse skills

Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.

• Assessing client connections to rogue Wi-Fi
• Planning captive portal security exercises
• Reviewing conditions for traffic interception

Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.

• Reviewing order and payment workflow integrity
• Testing concurrent coupon redemption or transfers
• Assessing JWT validation and GraphQL controls

Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.

• Planning an AWS, Azure, or GCP security assessment
• Tracing privilege escalation from current permissions
• Reviewing CI/CD credentials and OIDC trust settings