266 skills · sorted by relevance
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.
Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.
Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.
Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.
Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.
Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.
Test web APIs, authentication, and LLM features with six Python scanners. Check cross-site access rules, header injection, database inputs, and signed login tokens, then investigate hidden server behavior through external callbacks and chatbot responses.
Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.
Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.
Inventory old and undocumented API versions, then compare their authentication, request limits, input validation, and exposed fields with current versions. Uses API specifications and archived records to identify overlooked endpoints with weaker security controls.
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
Assess Kubernetes and Docker security across exposed APIs, access permissions, service account tokens, and container boundaries. Use actual data reads or command output to establish impact and distinguish information exposure from broader compromise.
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.
Test whether an application accepts forged JWTs, signed tokens that carry identity and role information. The skill covers signature bypasses, algorithm confusion, and untrusted keys, then guides verification of access to another user's data or protected functions.
Review CORS, the browser rules governing access between websites, to find unsafe origin permissions on APIs. Verify whether an attacker-controlled site can read sensitive signed-in responses in a real browser, separating header warnings from demonstrated impact.
Assess SSH services by discovering servers, reviewing encryption settings, testing passwords and keys, and investigating known vulnerabilities. Includes guidance on SSH tunnels and port forwarding, with reports covering configuration, authentication weaknesses, and forwarding setups.
Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.
Understand common web application vulnerabilities through organized explanations of their causes, impacts, and mitigations. Use the reference to review authentication, APIs, access controls, and configuration issues, or build checklists for security assessments.
Assess Linux systems for weaknesses that let a regular user gain administrator access. Guides inspection of permissions, scheduled tasks, and vulnerable components, with findings, evidence, and remediation recommendations documented for review.