Results for “you”

You are helping a penetration tester extract credentials from Active

The English summary is being prepared. Showing the original description.

You are helping a penetration tester establish persistent access in Active

The English summary is being prepared. Showing the original description.

You are helping a penetration tester enumerate and exploit Microsoft

The English summary is being prepared. Showing the original description.

You are helping a penetration tester establish persistence through AD CS

The English summary is being prepared. Showing the original description.

You are helping a penetration tester exploit ADCS through template/CA access

The English summary is being prepared. Showing the original description.

You are helping a penetration tester enumerate an Active Directory domain and

The English summary is being prepared. Showing the original description.

You are helping a penetration tester exploit misconfigured Active Directory

The English summary is being prepared. Showing the original description.

You are helping a penetration tester force remote systems to authenticate

The English summary is being prepared. Showing the original description.

You are helping a penetration tester perform Kerberoasting (extracting TGS

The English summary is being prepared. Showing the original description.

You are helping a penetration tester with offline credential and file cracking.

The English summary is being prepared. Showing the original description.

You are helping a penetration tester use credential material (NTLM hashes,

The English summary is being prepared. Showing the original description.

You are helping a penetration tester forge Kerberos tickets for domain

The English summary is being prepared. Showing the original description.

LLM bugs are only worth reporting when they cross a trust boundary you can prove — an OOB callback, a verbatim-reproducible secret, a cross-tenant record, or code execution. A model 'saying something bad once' is confabulation, not a vulnerability. Read the False-Positive Gate before claiming anything.

The English summary is being prepared. Showing the original description.

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

The English summary is being prepared. Showing the original description.

Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged and host namespace sharing. Includes enumeration with capsh, amicontained, deepce, CDK, and nsenter. Maps to MITRE ATT&CK T1611 Escape to Host. Use this skill when the engagement scope includes container breakout, Docker escape, container privilege escalation, host access from container, or when you land inside a containerized environment and need to reach the underlying host.

The English summary is being prepared. Showing the original description.

You are helping a penetration tester exploit Kerberos delegation misconfigurations

The English summary is being prepared. Showing the original description.

You are helping a penetration tester enumerate and exploit Active Directory

The English summary is being prepared. Showing the original description.

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or...

The English summary is being prepared. Showing the original description.

You are helping a penetration tester escape from a containerized environment or

The English summary is being prepared. Showing the original description.

GraphQL gives clients exactly the data they need - no more, no less. One endpoint, typed schema, introspection. But the flexibility that makes it powerful also makes it dangerous. Without proper controls, clients can craft queries that bring down your server. This skill covers schema design, resolvers, DataLoader for N+1 prevention, federation for microservices, and client integration with Apollo/urql. Key insight: GraphQL is a contract. The schema is the API documentation. Design it carefully.

The English summary is being prepared. Showing the original description.

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup

The English summary is being prepared. Showing the original description.

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.

The English summary is being prepared. Showing the original description.

Web search and scraping via Firecrawl API. Use when you need to search the web, scrape websites (including JS-heavy pages), crawl entire sites, or extract structured data from web pages. Requires FIRECRAWL_API_KEY environment variable.

The English summary is being prepared. Showing the original description.

Use when you have a written implementation plan to execute in a separate session with review checkpoints

The English summary is being prepared. Showing the original description.