73 skills · sorted by relevance
Map Active Directory permissions, group memberships, and user sessions with BloodHound CE. Reveal paths from ordinary accounts to administrator privileges, prioritize findings, and document evidence for authorized assessments or checks after security hardening.
Assess an internal network from the position of an intruder or malicious insider. Covers discovering systems, testing paths to other machines and higher privileges, demonstrating sensitive data access, and documenting findings with remediation recommendations.
Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.
Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.
Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.
Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.
Explains how to assess paths from limited user access to administrator privileges on Linux and Windows. Covers local permission weaknesses and Active Directory, a Windows domain management system, with tool selection and documentation guidance for authorized testing.
Assess Linux systems for weaknesses that let a regular user gain administrator access. Guides inspection of permissions, scheduled tasks, and vulnerable components, with findings, evidence, and remediation recommendations documented for review.
Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.
The English summary is being prepared. Showing the original description.
Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.
The English summary is being prepared. Showing the original description.
Use Cloudsplaining when an agent needs to flag privilege-escalation paths and overbroad IAM permissions before an AWS policy change reaches production.
The English summary is being prepared. Showing the original description.
Exploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.
The English summary is being prepared. Showing the original description.
Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.
The English summary is being prepared. Showing the original description.
Identify and exploit misconfigured Linux Capabilities. This skill covers how attackers escalate privileges to root without relying on SUID binaries or kernel exploits by abusing excessive capabilities like cap_dac_read_search, cap_sys_ptrace, or cap_setuid assigned to ordinary files.
The English summary is being prepared. Showing the original description.
Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.
The English summary is being prepared. Showing the original description.
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.
The English summary is being prepared. Showing the original description.
Exploit misconfigured Docker environments, specifically focusing on privilege escalation via an exposed Docker daemon socket (`docker.sock`) or membership in the local `docker` user group to achieve root access on the host system.
The English summary is being prepared. Showing the original description.
Exploit local systems via DLL load order hijacking. This skill details how to identify applications on Windows that insecurely load Dynamic Link Libraries (DLLs) and how to substitute a legitimate DLL with a malicious one to achieve privilege escalation or persistent access.
The English summary is being prepared. Showing the original description.
Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda function abuse, and cross-account attack paths. Covers both external and authenticated AWS pentesting.
The English summary is being prepared. Showing the original description.
Exploit misconfigurations in AWS Cognito, specifically focusing on unauthorized identity pool access, user pool self-registration issues, and privilege escalation via custom attributes to access broader AWS infrastructure.
The English summary is being prepared. Showing the original description.
Exploit Server-Side Request Forgery (SSRF) vulnerabilities on Amazon Web Services (AWS) EC2 instances to access the highly sensitive Instance Metadata Service (IMDS). Circumvent basic protections and extract temporary IAM access keys, escalating privileges comprehensively across the AWS Cloud environment.
The English summary is being prepared. Showing the original description.
Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.
The English summary is being prepared. Showing the original description.
Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., `is_admin`, `verified`) to illegally modify restricted properties.
The English summary is being prepared. Showing the original description.
Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity
The English summary is being prepared. Showing the original description.